Pixee

After a 60-day disclosure period, we're releasing research into a class of medium-severity compaction-related bugs that many of the OSS coding agents have. It's a combination of classic injection, prompt injection, and trust boundary bypass. From the abstract of the paper: > We show that in popular open-source coding agents [compaction] is an exploitable trust boundary. Harnesses that flatten the typed conversation into a single plain string, marking each message with a text label such as [User]:, destroy message provenance in code, before the summarizer runs. An attacker who controls anything the agent reads can forge a user turn that survives compaction as a genuine instruction [in the user scope] In other words: 1. Bad guy provides malicious data to coding agent in web search turn (for example) 2. Causes compaction with giant message or rabbit-holing content 3. Bad guy provides genuine-looking instruction somewhere in malicious content 4. As part of compaction, attacker has their forged instruction promoted to user-scope 5. Agent is tricked into doing bad guy thing in session with attacker-provided instruction The bugs are not world-melting, but I find them interesting for many reasons: 1. How come the agents wrote this vulnerable pattern? Why did Codex get it right? 2. The combo recommendation of "escape untrusted inputs" and "use a more paranoid model" is so 2026. 3. This research shows LLM "message chains" are missing many security attributes. We need a new model. More on this later. In the paper we answer many follow-up questions and provide lots of pretty graphs: https://lnkd.in/evGiEgTW Thanks to Johnathan Gilday Adam Schaal of Pixee for review, to Idan Habler, PhD for brainstorming and providing a fix in DefenseClaw shipping later today. https://lnkd.in/erRE8Y7W

You already run enough tools to sort real threats from noise. Pixee replaces that scramble with one flow: it clears up to 95% of false positives, then ships fixes your developers merge 76% of the time. Fewer tabs. Less triage. More merged code.

You're measured on impact, not on how many alerts you close. Pixee gives you the numbers to prove it: up to 95% fewer false positives, and 76% of its fixes merged as written. Cleaner backlog, cleaner PRs, and evidence your team is raising code quality instead of chasing scanner noise.

Every scan dumps hundreds of alerts, and most are noise. Shipping features takes a back seat to chasing false alarms. Pixee quiets up to 95% of that noise and surfaces the fixes worth making. Your team merges 76% of them as written. Open your backlog to the handful that matter, not the hundreds that don't.

A hot take for those folks only superficially tracking engineering in the AI learning space: Fine-tuning is the wrong answer for almost everything AppSec. So is RLHF. So is RLFT. So is whatever flavor-of-the-month adaptation technique made it to your favorite AI newsletter. Here's why we picked case-based reasoning instead. When an engineer marks a finding as a false positive, you need three things from the system: 1. Recall the decision next time a similar finding appears 2. Show your work — why did it classify the new finding this way? 3. Don't require a 50,000-example dataset to do either Fine-tuning fails on #2 (decisions vanish into weights you can't interrogate) and #3 (you'll never have org-specific data at that volume). RLHF inherits both problems and adds latency. Arbitrary form compaction memory has weaker recall and unpredictable behavior under pressure. CBR keeps each decision as a discrete, retrievable case. Thumbs-down a finding, write one sentence explaining why ("upstream middleware sanitizes this"), and we store it. Next scan, we pull the closest matching cases and show you which ones drove the verdict. It's slower to build, and harder to engineer. It's also the only architecture that survives gives an enterprise the observability, auditability, access control, etc., you need. If your AI security tool can't tell you *why* it agreed with you last quarter, it's not learning, it's always going to be hard to trust. We shipped this in AutoTriage. Full technical reasoning + example from Apache Roller walkthrough — link in comments.

Another busy week in #AppSec with AI fueled trends showing no signs of slowing down