Who Is Prompt-Injecting Coding Agents? Radware's Scan of 86 Million GitHub Items ([un]prompted II)

Two and a half per hundred thousand. That is the figure Gabi Nakibly (Radware) and Zvika Babo (Radware) bring to [un]prompted II — people type it unprompted — and it may be the most useful number in our guide to the conference, because it is the only one on the programme measured against a population rather than a lab. The disputable claim: hidden-text prompt injection in public repositories is now a background condition of software development, not an incident class.

Nakibly and Babo speak on Day 1, Stage 2, at 11:35, per the official agenda as published on 2026-10-12. This brief is written from the published abstract, before the talk. We are independent coverage — not the organiser, not a sponsor, not a media partner — and we are following remotely. Nothing here is a quote, and the agenda can change.

What the talk says it will show

A GitHub-wide scan of 86 million items for hidden-text prompt injections, finding about 2.5 per 100,000 items. The abstract says the goals vary: agent orchestration, growth hacking and data exfiltration. The team releases its detector and taxonomy.

Our arithmetic on those published figures, not theirs: on the order of two thousand carrier items across the corpus scanned. Treat it as a magnitude; the published rate is approximate. The taxonomy is the other half — one technique, three motives.

The only base rate on the unprompted agenda

Almost every other injection result on the programme measures susceptibility: given an attack, does the control hold? Vince Ovando (not listed) reports the Tantalus arena at about 6.1 million inference calls, with only one control that provably blocked bad outputs at 100%. Rock Lambros (Zenity) and Fred Wilmot (Detecteam) use the EchoLeak zero-click Copilot exploit to show models do not distinguish trusted from untrusted tokens.

Those answer "can it happen" and "what do they do". None answers "how often is it already there". A base rate is a different instrument: it turns an argument into a budget line, because it gives you a denominator. Susceptibility tells you a control is needed. Prevalence tells you how much.

The closest comparison on the agenda is the same day, same stage, 25 minutes later: Tamir Ishay Sharbat (Zenity) and Joao Donato report tens of thousands of agent skills tested with hundreds malicious. That is prevalence too, but across an artifact class the authors chose. Radware's denominator is whatever GitHub happens to contain, which is what makes it a base rate rather than a sample. The [un]prompted II glossary defines the terms both talks assume.

What the rate does not tell you

• A rate is not a risk. Your exposure is that rate times how much of the corpus your agents read, and what they can do afterwards. A coding agent with write access and a registry token is a different number from a read-only review bot.
• Intent is not in the text. Growth hacking and data exfiltration can use the same hidden paragraph; what separates them is the instruction, not the technique. A taxonomy built on observed goals infers motive, and the authors should say how confident that is.
• Every detector has a floor. One tuned for hidden text finds hidden text. An injection written in plain visible prose inside a legitimate-looking contributing guide is invisible to it, and arguably more effective.

We traced how one poisoned document moves through a chain of agents in prompt injection in multi-agent pipelines, and the ingestion side of it in supply-chain risk in agentic pipelines. This scan is the first thing we have seen that puts a denominator under either.

What we will be watching for

• The split by goal. Deliberate attack against growth hacking against research or test artifacts changes what the number means entirely.
• What an "item" is — a file, a repository, an issue, a comment — because the denominator decides the rate.
• Whether the rate is rising, and over what window. A trend line matters more to a defender than a snapshot.

If this holds, what changes on Monday

Run their detector over what your own agents consume, not over GitHub. The useful figure is your rate in your corpus: vendored dependencies, issue threads, documentation, anything an agent reads before it acts.

Then treat untrusted repository text as input, not context. Hidden text is the easy case and a stripping pass is worth having. The hard case is that the agent cannot tell an instruction from a description, so the control belongs downstream of the model, in what the agent may do with what it read.

Three questions we would ask Gabi Nakibly and Zvika Babo

1. What share of the findings were deliberate attacks rather than growth hacking or test artifacts, and how did you decide which was which?
2. What does the detector miss by construction — what injection would you expect to walk past it?
3. Is the rate rising? Re-run the scan today against the same corpus definition — which way does it move?