Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-05 · high
PRWeaver ran 208 verified attacks through six AI auditor systems; disguising the purpose beat splitting code across commits by up to 18 points.
Why now: The paper posted to arXiv in August 2026, timed to the same per-PR and batch-review tradeoffs teams face when deploying these auditors now.
AI auditors that catch 50-60% of malicious PRs reviewed one at a time catch just 16-22% of the same attacks bundled into a 24-PR window, per PRWeaver. The benchmark tested 208 execution-validated attacks pulled from ten real repositories, run through three PR-auditing agents across six auditor-model systems in 832 matched renderings.
That gap is the difference between a review process that catches a malicious PR before it merges and one that just produces a false sense of coverage.
Splitting a malicious change across multiple commits barely helps the attacker, dropping detection by five points at most. Interleaving it among concurrent, unrelated PRs costs the auditor 5 to 13 points. Fusing the malicious diff into a change whose stated purpose plausibly explains it works better than either, costing the auditor 10 to 18 points.
None of those attacker tricks comes close to matching the effect of batch size on its own. Widening the review window from one PR to 24 does more damage than any disguise tactic, and that doesn't depend on which auditor model runs the review.
The fix here is queue size, not model choice. Per-PR review catches more than double what whole-window review catches, across every system PRWeaver tested. Teams running AI PR review at batch scale to save reviewer time are trading detection rate for throughput, whether they've noticed it or not.
PRWeaver posted to arXiv in August 2026, testing the same per-PR and batch-review setups teams choose between when they deploy these auditors.
Each link below shares sources, entities, or timing with this story.
Shared entity: Splitting / Same source domain / Shared topic / Earlier coverage / Tension
Both cover Splitting; reported by the same outlet (arxiv.org); overlapping topics (agent, attack, barely).
Shared entity: PRs / Same source domain / Shared topic / Earlier coverage / Tension
Both cover PRs; reported by the same outlet (arxiv.org); overlapping topics (agent, attack, review).
Shared entity: PRs / Shared topic / Earlier coverage / Tension
Both cover PRs; overlapping topics (agent, context, cost, review); earlier PRs coverage from 2026-07-28.
Shared entity: PRs / Same source domain / Shared topic / Earlier coverage / Tension
Both cover PRs; reported by the same outlet (arxiv.org); overlapping topics (agent, review).
Shared entity: PRs / Same source domain / Shared topic / Earlier coverage
Both cover PRs; reported by the same outlet (arxiv.org); overlapping topics (agent, point, review).
Both cover PRs; reported by the same outlet (arxiv.org); overlapping topics (agent, review).
Both cover PRs; reported by the same outlet (arxiv.org); overlapping topics (agent, context).
Same source domain / Shared topic / Tension
Reported by the same outlet (arxiv.org); overlapping topics (agent, attack, attacker, barely); pushes against this story (against).