Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Text planted to steer an AI reviewer V-044
Finds text planted in your resources to steer an AI reviewer, and names who wrote it.
Checks
| Checks | Needs |
|---|---|
| Finds a principal of yours writing text meant to steer an AI reviewer. | Live events: write_sample |
| Finds a record that carries text meant to steer an AI reviewer. | |
| Notes refused or outside calls that carried text meant to steer an AI reviewer. | Live events: write_sample |
Coverage
Could not read anything this run
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
None mapped.
How to fix
warden show (the cited events and records) and the principal's other calls in the window → decide who wrote the text and why; a stolen credential is deactivated (not deleted) by IaC as R-17, the text is removed by the owning team through the code that writes the record; read-only until then