Composite study

This is a product-class write-up, not a named-client story and not a results press release. Counts below describe the pack we actually write (approach points, tools, layers) — not invented bug totals or conversion lifts.

4
Approach points
5
Tools in the pack
5
Layers covered
3
Challenges documented

Overview

The agent’s “fix my build” path added a plausible npm/pypi package that was not on the registry at test time. That is a supply-chain incident waiting for a squatter.

A second path echoed a GitHub token that had appeared in a prior trace the model could see.

Industry pattern this is grounded in

Research on HalluSquatting shows coding agents will invent repository and package names at high rates. Adversaries register the invented names. Generated config that embeds secrets from traces is a second, quieter failure.

Highlights

Typical launch bar: Wait until journeys and evals agree — do not ship on demo scores alone.

Challenges

01

The agent had network on by default in CI, so a hallucinated install could have succeeded after squat.

02

Docs showed an API that did not match the live OpenAPI — the agent copied the docs.

03

Developers wanted autocomplete speed more than resolve checks.

How we tested

01

Generated install commands must resolve against the real registry or fail. No “this is probably the package.”

02

Secrets scanners on generated files; tokens from traces must not reappear.

03

Webhook signatures and token revoke on the product’s own install path.

04

Published rate limits behave as documented (429 + Retry-After).

Starting point vs what we required

Starting point versus the controls we required
Starting pointWhat we required
The agent had network on by default in CI, so a hallucinated install could have succeeded after squat.Generated install commands must resolve against the real registry or fail. No “this is probably the package.”
Docs showed an API that did not match the live OpenAPI — the agent copied the docs.Secrets scanners on generated files; tokens from traces must not reappear.
Developers wanted autocomplete speed more than resolve checks.Webhook signatures and token revoke on the product’s own install path.

What we delivered

01

Adversarial evals

  • Promptfoo — Invented package names and secret-echo
02

API / contract

  • Postman — Webhook signatures, replay, revoke
03

Journeys / UI

  • Playwright — Install → first successful action
04

Dependency review

  • Snyk — Dependency and generated lockfile review
05

CI regression

  • GitHub Actions — CI eval on agent prompt changes

Outcomes

Allow-listed package sources and a resolve-before-install hook. Secret-echo evals on generated Docker/env samples.

We tested the product’s webhook signature and revoke flows with Newman — the agent was not the only risk.

Stack

Testing stack used on this product class
LayerToolWhat we validated
Adversarial evalsPromptfooInvented package names and secret-echo
API / contractPostmanWebhook signatures, replay, revoke
Journeys / UIPlaywrightInstall → first successful action
Dependency reviewSnykDependency and generated lockfile review
CI regressionGitHub ActionsCI eval on agent prompt changes

Same method as the rest of our work: severity-ranked findings, pass rules in writing, and a ship / wait / block call. See the evaluation method and tool comparison.