Repository Agent-Security Gap Study — v2

<!-- SC_OFF --><div class="md"><p><strong>Submitted by:</strong> Adam Kruger <strong>Date:</strong> March 23, 2026 <strong>Models Solved:</strong> 3/3 (M1, M2, M3) + Warmup</p>

<h2> TL;DR </h2> <ul> <li>AI assistants trained on public repos reproduce hardcoded secrets because that's what they learned</li> <li>A pushed API key is effectively public even

<h1> Static Analysis for LLM Prompt Security: A Methodology for Pre-Deploy Vulnerability Detection </h1> <p><em>How applying SAST principles to LLM prompt strings catches security

<p>Every prompt injection defense I’ve seen makes the same mistake. It asks the wrong question.<br /> The wrong question: “Does this prompt contain dangerous words?”<br /> The

<p>Four agents entered an infinite loop in November 2025. They ran for 11 days. The bill was $47,000. Nobody noticed until it was over.</p> <p>The team was running a market

<blockquote> <p>A controlled study finds that data distribution, not just volume, dictates LLM capability. Benchmark-aligned training inflates scores but creates narrow, brittle

<p><em>The AWS Reliability Files, Part 1</em></p> <p>I told an AI a true fact about AWS. Then I had a second AI confidently insist it was wrong. Within one exchange, the first

<p>On April 24, 2026, an AI coding agent destroyed a company's entire production database in nine seconds. Thirty hours later, PocketOS customers were still showing up at car