[detection-stats] Detection stats for github/gh-aw - 2026-09-07

718 external-detector runs analysed · detection-job error rate 0% · soft failures 92 · threat rate 0.37%.

## Summary

# gh-aw detection statistics - 2026-09-07 (UTC)

Repository: `github/gh-aw`
Window: `2026-09-07T00:00:00Z` .. `2026-09-07T23:59:59Z`
API requests: 1932, rate-limit pauses: 1
Data complete: yes

## Totals

| Metric | Count |
|---|---|
| Workflow runs in window | 1862 |
| Agentic runs (`*.lock.yml`) | 1266 |
| Runs with a `detection` job | 865 |
| ... using the external detector | 718 |
| ... using the built-in detector | 147 |
| ... detector could not be determined | 0 |
| Agentic runs without a `detection` job | 401 |

All rates below are over the **external detector** population (718 runs). Since gh-aw #54111 the external detector is the compile-time default; a run counts as external when its `detection` job showed the `Install threat-detect binary` step, when another run of the same workflow did that day, or when the workflow is `.lock.yml` and no run showed the built-in shape (a completed detection job with steps but no marker). Runs on a workflow that opted out with `features: gh-aw-detection: false` count as built-in.

## Detection job outcomes

| Outcome | Count | Rate |
|---|---|---|
| `success` | 367 | 51.11% |
| `skipped` | 350 | 48.75% |
| `cancelled` | 1 | 0.14% |

**Error rate (failure/timed_out/action_required): 0%**

## Verdict availability

| State | Meaning | Count |
|---|---|---|
| `present` | detection artifact downloaded and parsed | 267 |
| `absent` | detection job ran but published no artifact (soft failure) | 92 |
| `skipped` | detection job was skipped or was still running (nothing to fetch) | 350 |
| `unreadable` | artifact zip could not be unpacked | 9 |

Green detection jobs that published no verdict: **92** (detection steps are `continue-on-error`, so a missing verdict artifact is the only reliable signal for these).

## Detection results

| Result | Count |
|---|---|
| Runs with a parsed verdict | 267 |
| Clean (no threat) | 266 |
| Any threat | 1 |
| `prompt_injection` | 0 |
| `secret_leak` | 0 |
| `malicious_patch` | 1 |

**Threat rate (of runs with a verdict): 0.37%**

## By workflow (top workflows, truncated — 241 further workflows omitted; see `stats.json` on the collection run)

| Workflow | Runs | Failed | Cancelled | Skipped | No verdict | Threats |
|---|---|---|---|---|---|---|
| PR Sous Chef | 80 | 0 | 0 | 0 | 0 | 0 |
| Q | 69 | 0 | 0 | 69 | 0 | 0 |
| Deployment Incident Monitor | 62 | 0 | 0 | 62 | 0 | 0 |
| Daily Trajectory Grader Implementer | 47 | 0 | 0 | 47 | 0 | 0 |
| Issue Monster | 46 | 0 | 0 | 2 | 8 | 0 |
| [aw] Failure Investigator (6h) | 46 | 0 | 0 | 43 | 0 | 0 |
| Avenger | 24 | 0 | 0 | 14 | 10 | 0 |
| Daily Go Test Parallelizer | 12 | 0 | 0 | 0 | 7 | 0 |
| Auto-Triage Issues | 11 | 0 | 0 | 5 | 3 | 0 |
| Contribution Check | 6 | 0 | 0 | 0 | 0 | 0 |
| Matt Pocock Skills Reviewer | 6 | 0 | 0 | 0 | 0 | 0 |
| Test Quality Sentinel | 6 | 0 | 0 | 0 | 0 | 0 |
| Workflow Generator | 6 | 0 | 0 | 6 | 0 | 0 |
| Design Decision Gate 🏗️ | 5 | 0 | 0 | 0 | 0 | 0 |
| Impeccable Skills Reviewer | 5 | 0 | 0 | 0 | 0 | 0 |
| PR Code Quality Reviewer | 5 | 0 | 0 | 0 | 0 | 0 |
| Ponytail Reviewer | 5 | 0 | 0 | 0 | 0 | 0 |
| Smoke Gemini | 5 | 0 | 0 | 4 | 1 | 0 |
| Code Scanning Fixer | 4 | 0 | 0 | 0 | 0 | 0 |
| Deep Report | 4 | 0 | 0 | 0 | 0 | 0 |
| PR Triage Agent | 4 | 0 | 1 | 0 | 0 | 0 |
| The Great Escapi | 4 | 0 | 0 | 2 | 1 | 0 |
| Changeset Generator | 3 | 0 | 0 | 2 | 1 | 0 |

_241 further workflows omitted; see `stats.json`._

## Notable runs

The single detected threat: **Daily Community Attribution Updater** — run [34076933480](https://github.com/github/gh-aw/actions/runs/34076933480), job conclusion `success`, verdict `present`, threat `malicious_patch`. All other notable runs listed in the raw data are `absent`/`unreadable` verdict cases (soft failures), no additional threats.

## Change since 2026-09-06

| Metric | 2026-09-06 | 2026-09-07 | Δ | 7-day mean (08-31→09-06) |
|---|---|---|---|---|
| External detector runs | 578 | 718 | +140 | 754.1 |
| Error rate (%) | 0.0 | 0.0 | 0.0 | 0.0 |
| Soft failures | 69 | 92 | +23 | 76.9 |
| Runs with verdict | 231 | 267 | +36 | 248.7 |
| Any threat | 0 | 1 | +1 | 0.14 |
| Threat rate (%) | 0.0 | 0.37 | +0.37 | 0.05 |

## Watch list

- Avenger — 0 failed, 10 without a verdict, out of 24 runs
- Issue Monster — 0 failed, 8 without a verdict, out of 46 runs
- Daily Go Test Parallelizer — 0 failed, 7 without a verdict, out of 12 runs
- Auto-Triage Issues — 0 failed, 3 without a verdict, out of 11 runs
- Smoke Gemini — 0 failed, 1 without a verdict, out of 5 runs

Collected by: https://github.com/github/gh-aw-threat-detection/actions/runs/34185193805
Full data: the detection-stats-34185193805 artifact on that run.

> Generated by [Detection Stats Daily](https://github.com/github/gh-aw-threat-detection/actions/runs/34185193805) · copilot · auto · 25.3 AIC · ⌖ 5.16 AIC · ⊞ 11.3K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw-threat-detection+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw-threat-detection%2Fdetection-stats-daily%22&type=issues)

This issue is a generated detection-statistics report and names no source files or tests to change. Start with the `stats.json` artifact on collection run 34185193805 and compare it with the summarized tables. No concrete completion criteria or implementation scope is stated.

Written by the indexing model from the issue text.