We are tracking new empirical data on AI code reviews today, as a causal study reveals bot-authored infrastructure changes frequently bypass human inspection entirely. Today's briefing also covers GitHub's new native dependency lockfiles for Actions, and a silent regression bug affecting the SAP Cloud SDK.
Adding to the AI review bottlenecks we tracked in recent Harvard and CRBugBench studies, a new causal study analyzing 26,999 public pull requests found that between 43.1% and 56.2% of AI-authored dual-scope PRs—modifying both application code and deployment infrastructure—merge without any human inspection in a median time under 31 minutes. The research established that bot identity reduces the likelihood of human review by 63.7% compared to human peers, while dual-scope tasks comprise roughly 4.5% of agent contributions.
Why it matters
Bot-driven infrastructure edits bypass review queues at alarming rates, requiring engineering leads to immediately enforce path-based CODEOWNERS rules and isolated workflow permissions.
Addy Osmani published an agent-skills repository featuring 25 Markdown instruction files designed to counter statistical shortcuts taken by LLM coding agents. The rules incorporate explicit anti-rationalization tables that block agents from skipping unit tests, weakening assertions, or bypassing security checks under the guise of task completion.
Why it matters
Encoding explicit anti-shortcut rules directly into repository instruction files provides an in-context guardrail against the statistical bias of agents to bypass failing test suites.
Cementing the open-source migration to full-length commit SHAs and recursive `pin-deep` audits we've been tracking, GitHub launched a public preview of native workflow dependency lockfiles for Enterprise Cloud accounts. Using the `gh actions-lock` extension, developers generate a `.github/workflows/actions.lock` file that prevents floating tags from silently pulling unreviewed upstream changes into CI pipelines.
Why it matters
Workflow lockfiles close the primary vector used in tag-swapping supply chain attacks by forcing cryptographic immutability on external pipeline dependencies.
Yesterday we covered the critical CVSS 10 SSRF vulnerability (CVE-2026-89111) in the SAP Cloud SDK for Python; today's updates reveal the flaw, initially patched in August, was accidentally reintroduced in versions 0.53.0 through 0.55.0. The regression in specific modules like `XsuaaAuthProvider` re-opens the vector for attackers controlling tenant subdomains to redirect OAuth2 token requests to external endpoints and exfiltrate client credentials.
Why it matters
Silent regression bugs in multi-tenant SDKs demonstrate why outbound authentication targets must be restricted via strict domain allowlists rather than relying solely on upstream library patches.
A proof-of-concept exploit was published for CVE-2026-82957, an SSRF vulnerability in Hyperledger FireFly Core's webhook event transport affecting versions up to v1.5.0. The endpoint fails to validate target URLs, allowing users to register loopback, RFC1918 internal addresses, or cloud metadata endpoints that receive outbound HTTP requests whenever events trigger.
Why it matters
Unvalidated webhook registration transforms event dispatchers into internal network scanners, requiring custom dial contexts that block private IP ranges at the socket level.
Reviewer Bias Accelerates Uninspected Agent Infrastructure Changes Data shows human engineers inspect AI-authored infrastructure pull requests far less rigorously than human-authored equivalents, driving rapid, unreviewed deployments of modified CI/CD pipelines and deployment manifests.
CI/CD Platforms Transition to Strict Immutable Dependency Locking In response to supply chain hijacking campaigns like GhostAction and SlugFest, platform maintainers are enforcing cryptographic commit-pinning and strict expiration windows on OIDC trust relationships.
Implicit Subdomain Routing Creates High-Severity Credential Exfiltration Vectors Multi-tenant Python SDKs and webhook transports that accept unvalidated tenant subdomains or target URLs continue to act as confused deputies, exfiltrating internal OAuth2 credentials to external listeners.