Replying to
@hasamba@infosec.exchange
@hasamba@infosec.exchange This is a clean example of why source review can't be the whole answer — the payload doesn't exist in the repo at scan time, it's fetched at runtime from a DNS TXT record. Static scanners, human review, even agent self-review are structurally blind to that.
Feels like the strongest argument for a boundary layer that watches what the agent actually does (shell exec, outbound connections, secrets/creds leaving the process) rather than what it was told to do. Ingress-side filtering can't catch an instruction that doesn't exist yet.