https://tokenise.rosvetic.com/tags/research/Recent content in Research on TokeniseHugoen-gbSun, 08 Nov 2026 16:02:00 +0000https://tokenise.rosvetic.com/posts/agent-security-prs-regex-shell-paths-what-to-review/Sun, 08 Nov 2026 16:02:00 +0000https://tokenise.rosvetic.com/posts/agent-security-prs-regex-shell-paths-what-to-review/<p>A study of 675 security-related pull requests written by coding agents found that most of the flaws a static scanner could see came from a short list: regular expressions that can blow up, shell commands built from strings, and file paths built from user input. Those three account for roughly 60% of all findings. They&rsquo;re also the three things a reviewer skimming an agent&rsquo;s diff is least likely to stop on, because each one looks like ordinary code.</p>