Sieve - Injection Tripwire for IBM Bob

THE PROBLEM In April 2026, a single attack vector simultaneously compromised three major AI coding agents - Claude Code, Gemini CLI, and GitHub Copilot - through a technique researchers called "Comment and Control." A malicious instruction hidden inside a GitHub comment made each agent leak sensitive data back through GitHub itself, with no external infrastructure required. Anthropic rated it CVSS 9.4 Critical. Separately, CVE-2025-54135 demonstrated remote code execution in Cursor via unauthorized file creation triggered by injected content, and independent audits have found over 24,000 secrets exposed in public MCP configuration files. The root cause across all of these incidents is the same: coding agents cannot distinguish between data they are reading and instructions they should follow. When an agent processes a GitHub issue, a pull request, or a fetched web page as part of its normal workflow, any text embedded in that content is treated as part of the agent's own context - including text an attacker planted there. THE SOLUTION Sieve is a security layer built for IBM Bob that solves this specific failure mode for the code review and debugging workflow. It intercepts every piece of external content Bob reads - GitHub issue bodies, comments, PR review comments, PR diffs, and web_fetch results - before that content can influence the agent's behavior. Each piece of content passes through two detection layers. L1 is a heuristic engine of 45+ regex patterns covering instruction-override phrases, exfiltration verbs, encoded payloads, and obfuscation techniques like zero-width Unicode and hidden HTML comments. L2 is a deterministic composite risk score combining part-of-speech imperative detection, Shannon entropy analysis, TF-IDF similarity to known injection patterns, and structural position analysis - deliberately built without any LLM, so the detector itself cannot be manipulated by the same kind of prompt injection it is designed to catch. Based on the resulting risk score, Sieve either allows the content through, blocks it outright, or routes it to a human-approval queue for borderline cases - and it fails closed: any internal error results in a block, never a silent pass-through. TARGET USERS Development teams using IBM Bob (or any coding agent) to triage GitHub issues, review pull requests, or process external content as part of their maintenance workflow - particularly teams in regulated or security-conscious environments where an agent acting on attacker-controlled input is an unacceptable risk. WHAT MAKES IT DIFFERENT Most prompt-injection defenses rely on another LLM to classify suspicious content - which means the defense itself inherits the same vulnerability it is meant to prevent. Sieve's detection layer is fully deterministic and auditable: the same input always produces the same output, and every decision can be explained by which specific pattern or signal fired. We validated this on a 35-row labeled dataset (9 malicious, 26 legitimate) with a 0/26 false-positive rate, and the full system passes 445 automated tests. Sieve also ships with a live dashboard (REST API + Server-Sent Events) showing every decision in real time, and a Custom Mode ("Security Guardian") that gates privileged actions - git push, shell execution, file writes - behind explicit human approval whenever the triggering content came from an untrusted source.