[detection-stats] Detection stats for github/gh-aw - 2026-08-29

702 external-detector runs analysed on 2026-08-29; detection-job error rate 0%; 28 soft failures; threat rate 0% (0 of 305 runs with a verdict).

## Summary

# gh-aw detection statistics - 2026-08-29 (UTC)

Repository: `github/gh-aw`
Window: `2026-08-29T00:00:00Z` .. `2026-08-29T23:59:59Z`
API requests: 2299, rate-limit pauses: 1
Data complete: yes

## Totals

| Metric | Count |
|---|---|
| Workflow runs in window | 2590 |
| Agentic runs (`*.lock.yml`) | 1457 |
| Runs with a `detection` job | 801 |
| ... using the external detector | 702 |
| ... using the built-in detector | 99 |
| ... detector could not be determined | 0 |
| Agentic runs without a `detection` job | 656 |

All rates below are over the **external detector** population (702 runs). Since gh-aw #54111 the external detector is the compile-time default; a run counts as external when its `detection` job showed the `Install threat-detect binary` step, when another run of the same workflow did that day, or when the workflow is `.lock.yml` and no run showed the built-in shape (a completed detection job with steps but no marker). Runs on a workflow that opted out with `features: gh-aw-detection: false` count as built-in.

## Detection job outcomes

| Outcome | Count | Rate |
|---|---|---|
| `success` | 418 | 59.54% |
| `skipped` | 284 | 40.46% |

**Error rate (failure/timed_out/action_required): 0%**

## Verdict availability

| State | Meaning | Count |
|---|---|---|
| `present` | detection artifact downloaded and parsed | 305 |
| `absent` | detection job ran but published no artifact (soft failure) | 28 |
| `skipped` | detection job was skipped or was still running (nothing to fetch) | 284 |
| `unreadable` | artifact zip could not be unpacked | 85 |

Green detection jobs that published no verdict: **28** (detection steps are `continue-on-error`, so a missing verdict artifact is the only reliable signal for these).

## Detection results

| Result | Count |
|---|---|
| Runs with a parsed verdict | 305 |
| Clean (no threat) | 305 |
| Any threat | 0 |
| `prompt_injection` | 0 |
| `secret_leak` | 0 |
| `malicious_patch` | 0 |

**Threat rate (of runs with a verdict): 0%**

## Reasons reported by gh-aw

From the `[aw] Detection Runs` tracking issue (warning/failure conclusions only), restricted to runs in the external-detector population above.

| Reason | Count |
|---|---|
| `parse_error` | 81 |
| `agent_failure` | 32 |

_Note: the by-workflow table in the raw summary was truncated after 20 rows (182 further workflows omitted) and the notable-runs table after 60 rows (53 further omitted); see `stats.json` on the run artifact for the full breakdown._

## Change since 2026-08-28

| Metric | 2026-08-28 | 2026-08-29 | Delta | 7-day mean (08-22..08-28) |
|---|---|---|---|---|
| External detector runs | 724 | 702 | -22 | 971.4 |
| Error rate | 0.0% | 0.0% | 0.0pp | 0.0% |
| Soft failures | 35 | 28 | -7 | 54.7 |
| With verdict | 297 | 305 | +8 | 376.6 |
| Any threat | 0 | 0 | 0 | 1.7 |
| Threat rate | 0.0% | 0.0% | 0.0pp | 0.49% |

## Watch list

- Issue Monster — 0 failed, 2 without a verdict, out of 47 runs
- Avenger — 0 failed, 2 without a verdict, out of 24 runs
- Design Decision Gate 🏗️ — 0 failed, 1 without a verdict, out of 21 runs
- Daily Go Test Parallelizer — 0 failed, 1 without a verdict, out of 12 runs
- PR Sous Chef — 0 failed, 1 without a verdict, out of 90 runs

Collected by: https://github.com/github/gh-aw-threat-detection/actions/runs/33291373482
Full data: the detection-stats-33291373482 artifact on that run.

> Generated by [Detection Stats Daily](https://github.com/github/gh-aw-threat-detection/actions/runs/33291373482) · copilot · auto · 27.1 AIC · ⌖ 6.76 AIC · ⊞ 11.3K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw-threat-detection+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw-threat-detection%2Fdetection-stats-daily%22&type=issues)

This issue is an automatically generated detection-statistics report, with full data available in the detection-stats-33291373482 artifact and stats.json. No source file, test, or requested change is identified, so the intended work and completion criteria cannot be determined from the issue.

Written by the indexing model from the issue text.