The report
A research census of GitHub content looked for instructions visible to coding agents but easy for a human reviewer to miss. The authors reported 2,281 hidden agent-directed message instances and a much smaller set of forty-seven classified hostile attempts. Much of the hidden material was ordinary coordination, templates or innocuous instruction text rather than a deliberate effort to seize control of an assistant.
The distinction between occurrence and effect is crucial. A hidden comment in a README does not have the same provenance as a malicious issue created by an outside contributor, and neither count proves that an agent executed the command. The study did not observe end-to-end compromise for each classified attempt. The research corpus and canonical analysis preserve the classification denominators and known selection limits.
For practical review, the actionable boundary is the moment repository content is promoted from task data into authority over code changes, shell commands or credentials. Render and label invisible bytes, retain contributor provenance and use an independent action gate. A detector that flags every hidden message without separating benign instructions from hostile ones can generate alarming numbers while providing little evidence about actual compromise.