Radar / Ideas / AttackPath Gate: the pre-merge attack…

AttackPath Gate: the pre-merge attack gate for agent pull requests

daily ideaambitiousJEV confidence 0.59JEV monetization 0.52026-11-05

OutcomeAgent pull requests that cannot merge while they open a new exploit path to secrets or privileged actions.

The problem

AI coding agents now run inside CI with real repository tokens, and a single crafted issue comment or prompt injection can hijack them into leaking secrets or poisoning branches — yet the standard pre-merge checks (lint, tests, DAST) cannot see agent behaviour at all.

The idea

A CI gate for repositories where AI agents run in the pipeline. On every pull request touching agent code, prompts or tool permissions, the gate spins up the agent in an air-gapped sandbox, attacks it with chained exploits (prompt injection via issue text, tool misuse, credential exfiltration paths), and blocks the merge if a new path to a secret or a privileged action opens. Every break becomes a permanent regression eval, and the gate re-runs the attack after the fix to confirm the path is closed before unblocking. The MVP covers GitHub Actions plus one agent harness, and deliberately skips production monitoring and general web scanning.

Why now

CrowdStrike's November 4 emulation launch proves chained adversary simulation is the direction of travel, BotGauge already turns breaks into permanent evals, and the August 2026 Black Hat disclosures showed the exact CI-secret attack class is live in the three leading agent harnesses today — but no pre-merge gate product yet ties the three together.

What it combines

CrowdStrike's chained attack-path emulation plus BotGauge's break-into-permanent-eval loop plus kosa8's air-gapped agent sandboxes: together they become a pre-merge gate that attacks the agent change itself, proves the fix, and banks the regression — not a scanner, not a periodic pentest.

MVP

Weekend MVP: a GitHub Action that runs a fixed pack of five prompt-injection and tool-misuse attacks against an agent in a sandbox on one demo repo, and fails the check when any attack reaches a planted secret. Skip: custom attack authoring, multi-harness support, and the permanent-eval library UI.

How it makes money

Budget owner: the AppSec lead or platform security team that already buys application security testing. Pricing anchor: Burp Suite Professional at $499 per user per year (portswigger.net/buy/pro) — the per-seat scanning budget this augments for the agent layer. Willingness-to-pay evidence: teams already pay for DAST seats, and Black Hat USA 2026 disclosures showed unprivileged GitHub issues reaching CI runner secrets in Claude Code, Gemini CLI and Codex workflows, which is exactly the failure class this gate catches before merge.

The moat

Traditional DAST incumbents scan HTTP requests, not agent behaviour: rebuilding as an agent-aware, sandbox-executed chaining engine means abandoning their request-based architecture and their per-seat scanner pricing for a per-pipeline gate. Their business model sells finding web bugs; this sells blocking agent merges, a different buyer conversation.

Distribution

Sold to AppSec and AI platform teams as a CI check: a GitHub Action that runs on agent-related pull requests. Wedge is B2B2C through CI and agent-framework vendors that bundle the gate as their security story.

Why it wins

Unlike DAST scanners that probe web endpoints, this gate executes the agent itself in a sandbox and attacks its tool use and prompt handling; unlike periodic pentests, it runs on every agent-related pull request and re-verifies the fix before unblocking.

Risks

Biggest risk: false positives that block legitimate merges will get the gate disabled. The MVP de-risks it by shipping with a tiny, high-precision attack pack and a one-command local replay so developers can see exactly which attack succeeded.

Build it with

CrowdStrike Agentic Adversary Emulation: AI red teams that chain attack pathsThe chaining model: attack paths linked to critical assets, with retesting until each path closes.
BotGauge: red-team platform that attacks AI agents, traces failures and turns each break into a permanent evalTurns each break into a permanent eval, so a fixed hole stays fixed.
kosa8: air-gapped microVM sandboxes for enterprise AI agentsAir-gapped microVM sandboxes where adversarial agents can run without touching production credentials.

Repo to start from

attackpath-gate: a CI action that adversarially tests agent changes in a sandbox and blocks merges that open new exploit paths.

Evidence

Get the week's best AI launches, plus 3 ideas worth building

One email every Saturday. Ranked by traction, not hype. Free.