Agent Security, in order.

Open questions 117 open

• Agent Data Injection (ADI)4 open
  • SourceThe complete defense (CaMeL Strict) costs ~50pp of utility. Is there a fine-grained trusted/untrusted data-isolation scheme that stops ADI without the deterministic-flow-tracking utility collapse — or is the trade fundamental? Partially answered: APPA (Kravchenko et al., Archestra AI, arXiv 2607.24625, empirical) settles the "or is the trade fundamental" half and leaves the "stops ADI" half open. Its finding is a diagnosis: the collapse is not intrinsic to deterministic flow tracking, it is a property of tainting retrospectively into a single monolithic context. Once the harness can branch, a restrictive read goes to a disposable child trajectory whose label descent never reaches the parent, and the parent's downstream tools stay live — 31–50% ASR down to 0–7% at a cost of 0–26pp of episodes rather than ~50pp, and on the strongest model measured (GPT-5.6 Luna) 95% utility at 2% ASR against 92% unenforced, i.e. no cost at all. Label creep is an artifact of the data model, not a law. What stops this from retiring the question, in order of severity: (1) CaMeL Strict is never run — it is cited in a comparison table and nothing else; the only executed baseline is Fides, which the authors themselves call not feature-equivalent and whose ASR is a constant 12/42 across all four models (a policy-expressiveness mismatch, not a defeated defense). The ~50pp figure is bypassed, not refuted. (2) ADI itself is never run against it. APPA's threat model is flow between sources and sinks; a correctly-declared contract would label a forged comment author with its untrusted source, which is the right shape — but the paper's own residual breach (hide-secret-in-status, a token smuggled inside an authorized send to a legitimate reader) is exactly the flow ADI rides, and the authors state plainly that content confinement inside an authorized send is not something a label algebra over recipient sets claims to provide. (3) Vendor-authored design on a purpose-built benchmark, where most of the branching gain sits inside scenarios declared unwinnable without branching, and where the same system on a third-party benchmark (AgentDojo) costs 21–30pp — three quarters of it harness mediation overhead. So the remaining question is narrower and sharper than the original: run CaMeL Strict and a branch-confining engine on the same ADI corpus.
  • SourceRandomization is cheap and effective for key-value formats but useless for unstructured formats (Markdown, prose tool output). What protects the formats a nonce can't be attached to? (Scope note, 2026-09-02: observability log fields are not in this question's scope even though they read like it — see Observability-Pipeline Poisoning. They are key-value and nonce-reachable; they simply carry no tag, or carry one nothing reads. Keep this question about formats where fencing is impossible, not channels where it is merely absent.) (Sharpened, not answered, by Rehberger's macOS Terminal chain (case-study): its remediation — encode control characters by default at the render boundary, raw output by opt-in — is a control on unstructured text that works without any nonce, because it makes the attacker's bytes non-structural at the point of interpretation rather than fencing them at the point of authorship. But it defends the sink, not the source: it protects a renderer from an agent's output, where this question asks what protects an agent from unstructured input. The right generalization to test is whether the same move exists on the input side — a canonicalizing decoder that strips or escapes structure-bearing sequences from untrusted prose before the model reads it — which is close to the paper's own sanitization row, measured here at a large utility cost. So the answer space now has two named shapes (fence the boundary; neutralize the bytes) and neither yet has a cheap unstructured-input instance.) (A direct instance, still not an answer: Måløy's Copilot for Word disclosure (case-study, 2026-07-28) is this question's worst case in a shipping product — a .docx attachment, no key-value structure anywhere, and the concealment channel is not a delimiter but visual formatting that Copilot strips before the text reaches the model, so what the model reads is a strict superset of what the user sees. Two mitigations failed to close the class and it was still reproducing at publication. It does, however, name a third shape the answer space did not have: enforce visual parity at ingestion — give the model only what renders visibly — which is "neutralize the bytes" moved from the render boundary to the read boundary, and is deterministic and non-LLM. Untested by anyone, and it addresses only the concealment half; a visible instruction still injects.)
  • ADI was demonstrated on GPT-5.2-class agents. Does frontier model improvement reduce probabilistic-delimiter susceptibility, or does capability leave the delimiter-misreading intact (making it a durable architectural property, not a scaling-away gap)? Partially answered: Can Models Learn to Separate Instructions from Data? Durable Property vs Training Gap — capability does reduce per-boundary susceptibility (instruction injection went ~0% under hardening; newer models resist undefended static injection), so the prediction is that it lowers the trusted/untrusted-data ASR too — but never to a clean zero under an adaptive attacker, and the delimiter-misreading mechanism survives every model improvement. Still untested directly on the trusted-data boundary for the newest models — the measurement this question asks for remains open.
  • SourceDo internal/white-box monitors detect an ADI payload at all, given it is engineered to read as trusted data rather than as an attack? (Untested; the tension flagged under Connections.)
• Agent Identity and Authentication1 open
  • SourceHardware-bound credentials assume attested hardware everywhere agents run, including ephemeral cloud workloads and sub-agents. How does attestation work for short-lived spawned sub-agents that "have up to the same permissions as the parent"? Partially answered: AIMS specifies the credentialing and delegation mechanism — a spawned agent is just another workload that gets its own WIMSE/SPIFFE identifier and short-lived credentials (SPIFFE provisions ephemeral key material per credential), is posture-assessed at each issuance, and receives the parent's authority downscoped via OAuth Token Exchange + Transaction Tokens + cross-domain identity chaining — i.e. delegated, transaction-bound tokens, not raw inheritance of the parent's credentials (a stronger answer than "same permissions as the parent"). But AIMS dissolves rather than solves the specific hardware-attestation question: it makes hardware backing optional and replaces per-sub-agent hardware attestation with deployment-specific posture signals — so how hardware remote attestation flows to a seconds-lived sub-agent remains unaddressed (AIMS argues you don't need it). Sharpened, not closed, 2026-09-02: the broker paper above supplies the first measured statement of what is at stake in that choice — sender-constraining (its R3) is only as strong as workload-identity attestation, demonstrated by a twelfth attack that succeeds by design when the attacker can present the victim's SVID. So the question stops being "is hardware attestation necessary?" and becomes "what attestation strength does an ephemeral sub-agent actually get, since that number is the strength of its credentials?" — and neither AIMS, the ebook, nor this paper measures it for a seconds-lived workload.
  • ResolvedJIT + ABAC are both labeled "advanced, not easily implemented." Is there a pragmatic Enterprise-tier midpoint, or is the gap from Foundation static roles to Advanced JIT a cliff? Answered: Foundation → Enterprise → Advanced: Is the Agent Access-Control Jump a Cliff? — not a cliff; the Enterprise tier (ABAC + dynamic privilege elevation with return-to-baseline + mTLS + sandboxing) is the deliberate midpoint, and ABAC's "advanced" framing is a source inconsistency (it sits at Enterprise in the tier table). Sub-agent attestation remains open.
• Agent Identity Management System (AIMS)6 open
  • WaitNo WG consensus. This is an individual submission profiling other still-in-progress drafts (WIMSE identifier/creds/WPT/HTTP-sig, OAuth transaction-tokens, identity-chaining are all Internet-Drafts too). Which of these primitives actually reach RFC, and does the composition survive WG review? "Who governs the agent-auth protocol layer" (Agent-Native Infrastructure) is proposed (IETF/CNCF/OpenID) but not settled. Sharpened by the OpenID AuthZEN drafts: the authorization slice is being standardized in a different body from AIMS's IETF identity/delegation work — the OpenID Foundation's AuthZEN WG approved AARP + COAZ as Working Group Drafts (a step past AIMS's individual-submission status, though still pre-ratification, community-review drafts). So the governance layer is concretely plural (IETF for workload identity + delegated authority; OpenID for the authorization decision + prerequisites) and actively moving — not one arbiter but a cross-body division of labor whose eventual composition is itself unsettled. Sharpened again 2026-08-04 by a third venue that ships: MCP spec revision 2026-07-28 (mcp spec 2026 07 28 changelog, vendor-claim) legislates its own client-registration and code-redemption rules under neither body — issuer-keyed non-reusable client credentials as a MUST, RFC 9207 iss validation as a MUST, and RFC 7591 Dynamic Client Registration deprecated in favor of Client ID Metadata Documents, the same primitive §10.10 above already names under Discovery. Two things follow. The composition question gains its first concrete convergence — an independent protocol reached for CIMD without coordinating with this draft — and it also gains a fourth arbiter, one that is not a standards body deliberating but a de-facto protocol shipping requirements into implementations while IETF and OpenID are still at draft. The trigger event for this question was always ratification; the observation is that a de-facto layer may settle the primitives before ratification does. Still #oq/wait — the question is which primitives reach RFC and whether the composition survives WG review, and neither has happened.
  • SourceMission → authorization is out of scope. The hardest part — translating a natural-language mission into concrete scopes/resources safely — is explicitly deferred as a "planning step." A manipulated planning step requests over-broad authorization; AIMS gives it clean primitives but no account of securing the translation itself.
  • Mid-execution human-in-the-loop. The draft admits CIBA only models client-initiated approval and "doesn't map well" to confirmation needed mid-execution — an acknowledged specification gap. Addressed (in proposal) by the OpenID AuthZEN AARP draft: AARP generalizes CIBA's async out-of-band interaction into a general prerequisite/approval pattern — "not yet, here is what is required" — not confined to client-initiated flows and satisfiable by a person or an automated governance system mid-flow, with policy re-evaluated at enforcement. So the gap now has a proposed standards answer — but a Working Group Draft, not a ratified spec, and not yet integrated with AIMS's IETF stack.
  • NotePosture assessment is deployment-specific by design. By requiring no particular attestation mechanism, AIMS makes interoperability of trust assurance (not just protocol) unspecified: two conformant AIMS deployments can assess posture with wholly different, non-comparable signals.
  • SourceNo empirical evaluation. Unlike Out-of-Band Prompt-Injection Defense (which at least ran one adaptive reproduction), AIMS is a design document with no measured attack-resistance — its security rests on the composed specs' own (mostly non-agentic) threat models. Partially answered (2026-09-02) by Dantuluri & Sundi (delegation without trust agent authz gap analysis, empirical, VotalAI COI): an AIMS-shaped composition — OIDC-rooted capability token, SPIFFE-style SVID, issuer-mediated token exchange minting an attenuated SVID-bound short-lived token at every hop, revocation propagation, tamper-evident log — has now been built and attacked, blocking all four modelled threats where a bearer-credential runtime fails all four, resisting 11 hand-built design attacks, accepting 0 of 200,000 forged/mutated tokens, confining a compromised sub-agent to a mean 1.5 of 8,100 reachable actions, at ~2.6 µs per decision. Three reasons it is a partial and not an answer: the artifact is a ~160-line unreleased demonstrator with a different token format (macaroon-style HMAC caveats, not WIMSE WPTs), so this is evidence that the shape holds, not that this draft's stack does; the measurement runs against an abstract tool/resource action model with no live model in the loop; and the composed-specs threat models the question actually indicts are untouched — the paper assumes the infrastructure and PEPs are trusted and correctly implemented.
  • SourceIntegration and a live model are the paper's own next step, and nobody has taken it. The one measured broker is not wired into any of the frameworks it audits, and every agent in the evaluation is scripted. Does an attenuated, SVID-bound, PEP-enforced delegation chain survive integration into a real framework (LangGraph, CrewAI, AutoGen, or an MCP client) driven by a live, injectable model — and does the per-hop exchange stay usable when the model, not a script, is choosing the sub-task the token is attenuated to?
• Agent Self-Poisoning (the CREATE-Path)3 open
  • SourceDoes the counter-prompt survive a white-box attacker holding its exact text? The six adaptive banners of Table 7 were written to evade the idea of the defense — rename its tokens, drop the imperative markers, disperse the block, override it in-body — and none exceeded 1.3%. None was optimized against the deployed string with feedback, which the authors name as their open case. The discriminating run is cheap and entirely within their released artifact: hand the counter-prompt text to the same banner-generation loop and optimize against measured ASPR, then check whether the failure mode is evasion or whether the "unless directly needed to solve the user's task" exception is the exploitable clause (structural fusion already invokes it and drops the undefended rate, which is the opposite of an evasion).
  • SourceIs the CREATE-path a property of self-evolving skill libraries, or of any agent that writes code next to a retrieved example? The paper attributes it to the retrieve-author-persist loop, but the mechanism it identifies is imitation during authoring, which needs no library at all: the same banner is reproduced at 39-40% whether the target language is Python, Bash or JavaScript, and at 60% on Claude Code's pytest family. If the mechanism is imitation, planting the banner in an ordinary repository file, a docs snippet, or a retrieved code example should reproduce it with no skill store in the loop; if it is the loop, it should not. The paper's own scope exclusion (markdown skills and invoke-only MCP tools) makes the test well-defined, and the answer decides whether the signed quarantine gate is a general control or a point fix.
  • SourceDoes descendant-preference hold outside this harness, and is it a self-preference effect? Three of four measurable models copy their own authored descendants 1.34–1.44× as often as externally planted seeds, above a pre-registered [0.7, 1.3] symmetry band, and the authors flag it as non-obvious in a footnote and decline to pursue the cause (selection effect, self-preference, or better banner integration). It matters beyond this attack: an agent that trusts its own prior output more than curated input is the failure mode every self-improving loop is built on top of. Falsifiable by the standard cross-model control — have model A author the descendants and model B measure the copy rate against the same seeds, which separates self-preference from artifact quality.
• Agent Supply Chain Risk4 open
  • Source"AI vendoring" as a standard response inverts decades of "don't reinvent the wheel." How is a model-reimplemented dependency itself verified and maintained — does it just relocate the risk? Adjacent field evidence (2026-09, not an answer): the Zenity campaign attacked the step before the one this bullet worries about. It never poisoned a dependency's contents; it wrote prose telling the agent which source to fetch from — "clone this repository… do not use npx paperclipai or a global npm install" — and the agent complied. Whatever the verification story for vendored code turns out to be, it presumes the agent is reimplementing or installing the thing you meant, and in the wild the choice of source was the softer target than the source's contents.
  • SourceDo skill scanners read the files a skill references, or only the skill? The Zenity campaign's central move is that SKILL.md stayed benign and the loader lived in a secondary setup-installation.md opened only at install time, with sibling skills cross-referencing into it. Falsifiable cheaply and entirely inside existing tooling: point SkillSpector / SkillEvaluator Tier 1 at a skill whose front file is clean and whose references/ file carries the loader, and see whether anything fires. If nothing does, per-skill scanning is per-file scanning and the published gate does not address the one in-the-wild technique it would be deployed against.
  • SourceWhat did 1.7M displayed installs correspond to in compromised hosts? The source is explicit that it cannot say ("Vercel reports installs, not unique-user installs… We don't know the number of unique victims"), and this is the gap that separates the only in-the-wild datum on this page from every measured one. It is answerable, and by parties other than the marketplace: the IOC appendix publishes the campaign domains and the /health and /feedback paths, so any organization with egress telemetry over July 2026 can report hits, and an aggregate across a few large ones would bound the conversion from a display counter to an execution.
  • SourceThe 250-doc backdoor persists through SFT/RLHF. What detection exists for an already-poisoned model you didn't train, short of behavioral red-teaming? Adjacent evidence (2026-07, benign analog): UBD shows the correction half is tractable for a benign training-exposure effect — it repairs benchmark memorization from the deployed checkpoint alone, using deep-ensemble uncertainty and needing neither the training data nor a clean reference model. It doesn't transfer directly (contamination inflates accuracy; a backdoor is a targeted malicious trigger that survives safety training), but it suggests ensemble-disagreement is a signal worth probing for the malicious case too. Adjacent evidence (2026-09, malicious, different substrate): EvoMal runs the detection half of this question on an artifact store rather than on weights, and every mainstream detector fails at both stages — name blocklist 0%/0%, Llama-Guard-3-8B 25% on seeds and 2% on authored copies, Prompt-Guard-86M catching every seed at a 47% benign false-positive rate, Bandit at 85% on authored code collapsing to 7% under a one-line egress swap. The transfer is limited (a skill file is readable source, not an opaque checkpoint), but it establishes the shape of the answer on the easier substrate: scanning the artifact is a capability problem, and scanning the attacker's submission is a structural dead end (Theorem 1). First field evidence (2026-09, case-study, and it is worse than the lab result): in the Zenity campaign nothing detected the poisoned artifact for a month of trending. What did detect it was a researcher detonating a batch of marketplace skills in a sandbox and watching the credential collection happen — behavioral, at runtime, by a third party with an analysis lab, on an artifact that had already been installed on an unknown number of hosts. And on the two occasions the same actor shipped code instead of prose, automated registry analysis caught it in under two hours and within the hour. Read together, the field datum and EvoMal point the same way: detection of an already-poisoned artifact is tractable where the artifact is code with a signature and has no demonstrated method where the artifact is instructions.
• Agentic Prompt Injection2 open
  • NowSpotlighting and constitutional classifiers each leave a residual (2%, 5%). Stacked, what's the realistic floor, and does it hold against adaptive attackers who know both are deployed? (Partly answered by the Opus 4.8 live bug bounty: adaptive expert red-teamers still find attacks on the bare model; deployed probes add uplift but don't zero out the residual. Sharpened by AutoDojo (Ma et al. 2026): a 0% static ASR is not a floor — a cheap black-box adaptive attack, not just a white-box one, recovers 28% overall (64% on action-open tasks) against a filter that scored 0% static. So the realistic floor against a filter defense on a vulnerable model is double-digit, not zero. But the same attack barely moves ASR on newer capable base models — showing the floor is a property of the model, not the layered filter defense.) Partially answered: Does 'Impossible, Not Tedious' Kill Defense-in-Depth? Layered Friction, Agent-Relativity, and the Frequency Paradox adds the structural half — stacking in-band layers cannot lower the adaptive floor because the layers' failures are correlated (the adaptive loop optimizes against the joint deployed stack as one surface), so the floor of any pure-friction stack is the model's own robustness; the residual that remains open is the heterogeneous stack (friction + deterministic gate attacked jointly), which no adaptive attack has yet targeted.
  • SourceWhy did Opus 4.8 regress on prompt-injection robustness relative to Opus 4.7 despite broad alignment gains — a capability/robustness tradeoff, or an artifact of harder adaptive evaluation? Partially answered: the Opus 5 card shows the regression did not persist — one generation later the same adaptive attacker drops from 7.03% to 0.56% in coding and 31.5% to 3.70% in browser use, which rules out a durable capability/robustness tradeoff on this axis. It does not explain the 4.8 dip itself; Anthropic never revisits it.
  • Resolved"LLMs cannot reliably distinguish information from instructions" — is this a fundamental property of the architecture or a training gap that future models close? The framework treats it as durable. Answered: Can Models Learn to Separate Instructions from Data? Durable Property vs Training Gap synthesizes the cluster — durable at the level that matters: any single boundary is trainable (hardening drives instruction injection to ~0%) and capability lowers per-boundary susceptibility (undefended static ASR: Claude-Haiku-4.5 0.3% vs GPT-4o-mini 58.6%), but closing one boundary relocates the attack to the next finer one, because the root cause — probabilistic reading of inexact delimiters — is architectural; "wait for the next model" lowers the number, not the mechanism, so enforce the boundary out-of-band. Partially answered (component sources): Narisetty et al. (2026) argue it is durable and cite Zverev et al. (2025) — current models don't maintain a usable instruction/data separation, and neither prompting nor fine-tuning reliably induces one. Their prescription is to stop trying to fix it inside the model and enforce control/data separation outside it (deterministic action mediation), which independently held under adaptive attack far better than in-band defenses did. Not settled (open-weight 7B, one attack, no white-box test), but the durable-property reading now has an empirical leg. Choi et al. (2026) add a sharper twist: the instruction/data boundary does look trainable (model hardening drives instruction injection to ~0%), yet the same hardened models remain 22–50% vulnerable to ADI, which forges trusted data rather than instructions. Closing one boundary just moves the attack to the next finer one, because the root cause — the LLM's probabilistic misreading of inexact structural delimiters — is architectural. So the honest answer is now "durable at the level that matters": any boundary an attacker can imitate stays porous, and the fix is again enforcement outside the model (fine-grained provenance/data-flow tracking).
• AI Control vs. Alignment1 open
  • SourceKapoor & Narayanan assert boring control techniques "would already have prevented" the Hugging Face incident, but the escape ran on a genuine zero-day chained with deliberately-disabled classifiers, not a neglected control. Would the specific controls they name (sandboxing, least privilege, logging, tripwires) actually have stopped this chain, or only a differently-shaped one? No source in the corpus tests the counterfactual directly.
• AI-Accelerated Offense2 open
  • WaitAnthropic argues LLMs benefit defenders more long-term (like fuzzers) but attackers more short-term during the transition. How long is the transition, and what determines who wins it? Partially answered (2026-07-30): Hugging Face's incident disclosure supplies one determinant the framework didn't name — access to a model that will process attack data. The attacker ran unrestricted; the defender's frontier-API forensics were refused by safety guardrails and had to fall back to a locally-run open-weight model. So during the transition, part of "who wins it" turns on whether a defender has a vetted self-hostable model in place before the incident. One vendor-reported case; it names a factor rather than dating the transition. Sharpened (2026-08-03): re-attribution shows the "attacker ran unrestricted" clause was true for a reason the original reading missed — the offending models were commercial frontier models whose vendor had deliberately reduced their cyber refusals for evaluation. The determinant is not that attackers avoid guarded models; it is that the guardrail is a switch, and during the transition it gets switched off on the offense side (legitimately, for measurement) while staying on for defenders.
  • Source"Fundamentals strong enough that scanning finds fewer bugs" assumes defenders run the scanners first. What happens to organizations that can't afford continuous model-driven scanning? Still open, and the obvious datum doesn't settle it: Hugging Face is a well-resourced AI-infrastructure company and was breached anyway — which speaks to whether scanning suffices, not to what happens to organizations that can't afford it. No source in the corpus covers the under-resourced case. Still open after the first size-split data (2026-09-02), and the split runs the wrong way to be read as an answer: prophet state of ai in the soc 2026 (vendor-claim, self-reported) reports that organizations above 5,000 employees have had an ignored alert prove material three or more times in a year at 46%, against 13% for the smallest — the larger organizations reporting the worse outcome. The near-certain explanation is exposure volume (they take in vastly more alerts, and the survey's median intake is ~100/day against a mean near 1,000 at the largest environments), not capability, which is precisely why the split cannot be inverted into "small organizations are fine." What would answer this bullet is a rate normalized per alert or per asset, which no source publishes. Partially answered on the cost half (2026-09-23), and it relocates the affordability question. Antaeus (empirical) publishes the corpus's first list price for a repository-scale defensive scan — ~$15 per repository, ~$530 for 35, ~$27 per confirmed bug — which is below the noise floor of almost any security budget, so model-call cost is not what the under-resourced case is short of. The binding constraint the same numbers expose is analyst attention: ~50 candidate findings per repository and one confirmed bug per ~87 findings, after a pruning stage that already removed a quarter of them for free. That turns this bullet's question from "can they afford the scanning" into "can they afford to read the output," which is a headcount question and is the one thing an organization that cannot afford continuous scanning definitionally lacks. Still open as posed: no source measures outcomes for organizations that do not run the scan, and a 35-repository C/C++ study cannot chart how per-repository cost scales with codebase size.
• AI-Enabled Influence Operations3 open
  • SourceThe Breakout Scale distribution (mostly One–Three) is measured on operations disrupted early, by the party that disrupted them. Does any platform-side or academic study measure reach for AI-assisted influence operations that were not interrupted, so the low-reach finding can be separated from the intervention?
  • SourceA shared doctrine file produces uniform output among operators with no contact and no shared infrastructure. Does any attribution methodology detect that — a stylometric or instruction-level signature of a copied standing prompt — or does it defeat coordination detection outright?
  • SourceThe report says AI helped build the apparatus that "would otherwise need a staffed program office." Is there any case where the apparatus outlived the account ban, as the Mali surveillance platform did on AI-Enabled State Surveillance? Nothing here says either way.
• AI-Enabled State Surveillance3 open
  • SourceMali, Yemen and the Russian drone swarm all leave a working artifact behind an account ban. Is there any case in the corpus where a vendor's enforcement demonstrably removed a deployed capability rather than the actor's continued access to the vendor?
  • SourceThe refusal boundary tracks stated intent and not artifact function (a de-anonymizer, an identity resolver). Is there a published evaluation of refusal behavior on tool-construction requests whose only use is a prohibited act, separate from requests to perform the act?
  • Source"Thousands of investigations per month" from a single office, and "6,388 Iranians profiled in a single year", are the only throughput figures in the section, and both are the actor's own claims repeated by the vendor. Does any external reporting corroborate the scale of AI-assisted state surveillance output?
• Autonomous Defense5 open
  • Source"Measure agreement against a human for two weeks, expand if tolerable" — what agreement threshold is tolerable, and who owns the residual false-negative risk when the model dispositions an alert the human never sees? Partially answered (2026-09-02) by prophet state of ai in the soc 2026 (vendor-claim, self-reported, n=250): the threshold half now has population data and the answer is that it is being set much lower than the question assumed — of AI users, only 30% claim ≥90% agreement with what an experienced analyst would conclude, 44% report 70-89%, 22% report 50-69% and 4% do not measure it at all, while 43% auto-execute low- or medium-risk actions regardless. And the survey supplies the missing counterfactual for the risk half: the un-automated baseline is ~28% of alerts uninvestigated, with 60% of respondents having had an ignored alert prove material and 34% three or more times in a year — so the residual false-negative risk is not created by the automation, it is inherited. Still unanswered, and these are the parts the question was actually about: nobody reports a rule for expanding autonomy, the agreement band is nowhere cross-tabulated against the autonomy tier, and ownership — who is accountable when a model-dispositioned alert turns out to matter — is not asked. Note also that most of the agreement distribution is self-graded: only 32% of AI users benchmark against labeled datasets or red-team exercises.
  • SourceDefensive agents are high-value targets (compromising one yields powerful capabilities). Does concentrating detection in an Agentic SOAR create a single point of catastrophic compromise the distributed-human model didn't have?
  • SourceIf hosted-model guardrails refuse attack data, does a self-hosted forensics model become a baseline IR requirement — and how would an organization vet one in advance, given it must be capable enough for 17,000-event analysis and permissive enough to read live payloads? Partially answered (2026-08-03): the technical post-mortem specifies the bar even though it doesn't answer the baseline question — the model had to recover an XOR+compression scheme and its per-campaign key from the agent's own leaked logs, then build trace-analysis tooling, over ~17,600 actions. So "capable enough" means cryptanalysis and code generation over attacker artifacts, not summarization; and the deployed answer was a quantized open frontier MoE on the org's own endpoints (nvidia/GLM-5.2-NVFP4), which puts the hardware cost within reach of anyone already serving models. Still unanswered: whether an organization without HF's inference infrastructure can hold this posture, and what a pre-incident vetting procedure would even test.
  • SourceSelf-reported agreement is the only agreement measurement in the corpus, and only 32% of AI users benchmark verdicts against labeled datasets or red-team exercises while 30% claim ≥90% agreement with an experienced analyst. Does self-reported agreement track measured agreement, and in which direction does it err? Directly testable: run a labeled verdict set through a sample of deployments and compare each org's measured agreement against the band it reports. Perception-lags-reality predicts an optimistic skew; the one prior instance where the vault could check a self-report against an instrument (DX's AI-code share against Google's byte-level provenance) went the other way, so the direction is genuinely open.
  • SourceThe 43% of AI users who auto-execute low- or medium-risk actions have no reported error rate. What is the rate of harmful auto-executed containment (wrongful quarantine, revocation, session kill) in that band, and how does it compare with the ~28% uninvestigated-alert loss it displaces? This is the false-positive cost of moving the dial, and no source in the corpus prices it — every account here, including StampHog in the coding domain, reports volume and never harm.
• Autonomous Intrusion3 open
  • Source~~The guardrail asymmetry rests on one vendor's account with no named APIs and no refusal detail.~~ (The naming half is settled: HF's technical timeline names Claude Opus and Fable as the models that refused, with a screenshot of an Opus refusal. The refusal stage is still unstated.) Do frontier providers offer an incident-response exemption (enterprise terms, abuse-analysis carve-out) that would have unblocked the analysis, and if not, does one appear now that a first-party disclosure has named the problem? Partially answered (2026-08-03): OpenAI added Hugging Face to its Trusted Access for Cyber Program after the incident — an exemption mechanism exists and was granted post hoc to this victim. What is still unanswered is whether such access is obtainable by an arbitrary defender before an incident, which is the form the recommendation requires, and whether Anthropic offers an equivalent for the model actually observed refusing.
  • SourceHugging Face reports "no evidence of tampering" with public models, datasets, Spaces, or container images — the claim that separates an internal breach from an ecosystem supply-chain event. What verification supports it, and will any independent report corroborate it? No IOCs were published, so no third party can currently check. Partially answered (2026-08-03): the second first-party account is consistent with it — OpenAI describes a narrow objective (the ExploitGym answer key) and says it "has not identified any other activity at the level of severity or scale." That is a second interested party agreeing, not corroboration, and OpenAI's "platform-level compromise" wording sits awkwardly beside HF's narrower framing. Further partial answer (2026-08-03): the technical timeline names the verification — every repository the stolen source-control token could reach was reviewed for unauthorized commits, branches and workflow changes, and published container images and packages were checked against their expected digests. It also concedes more than the first disclosure did: contents:write on internal repos was real and used (a PR was opened to try to compromise CI), it just produced no change that shipped. So the negative finding now has a stated method — self-administered, with indicators redacted, so still uncheckable from outside.
  • Source"A swarm of short-lived sandboxes" with self-migrating C2 leaves few durable per-host indicators. Does agent-driven intrusion structurally break IOC-based detection and sharing, forcing detection onto behavioural and volumetric signals? Partially answered (2026-08-03): the mechanism is now observed rather than inferred, and it points the same way — each sandbox run took a fresh VPN node IP, a randomized hostname and a re-downloaded toolchain; the C2 envelope was transport-agnostic across 100+ single-use capture endpoints, pastebins, dataset commits and error-message text; payloads were XOR+gzip packed under a per-campaign key, so HF's own naive text scan of its own capture missed ~75% of the exposed secrets. And the victim's remediation moves exactly where the question predicts: behavioral-signature alerting plus flagging tokens used from unexpected origins, not indicator matching. What is not answered is the structural/industry half — HF deliberately redacted or genericized its indicators, so this source is itself an instance of IOC sharing not happening, and one victim's control choices are not evidence that indicator-based detection is broken in general. Further partial answer, running the other way (2026-09-17): Anthropic's September 2026 threat report publishes pages of indicators for four adversary-run AI cyber campaigns — domains, egress IPs with first/last-seen windows, malware filenames, SHA-256 hashes, Telegram group and bot IDs, onion addresses, exfiltration buckets — and states they were shared with authorities, industry partners and victims. So the structural claim is disconfirmed at the sharing end: agent-driven intrusion does not prevent indicator publication, and HF's silence was a disclosure choice. It is not disconfirmed at the durability end, which is what the question was about: these indicators are vendor-side and actor-side rather than host artifacts from inside a victim, and GTG-20006's toolkit was rebuilt on every detection, so its file-level indicators are perishable by construction. The remaining question is narrower and sharper — do published indicators retain value against an actor running a closed detect-and-rebuild loop?
• Blast Radius (Agentic)3 open
  • SourceThe framework prefers identity-based isolation over network segmentation, but most enterprises have heavy segmentation investment. What's the migration path, and does dual-running create new gaps? Partially answered (2026-08-03) by Hugging Face's post-mortem (case-study, first-party) — the first deployed evidence in the corpus, and it answers the gap half more clearly than the path half. The breach ran straight through the dual-running seam: a service-connector credential that was one credential for all clusters, bound to system:masters, i.e. authority derived from reaching the broker rather than from being a named caller — a segmentation-era pattern surviving inside a Kubernetes estate. The remediation is the migration in miniature (workload identity where it was absent, per-cluster connector credentials, pod-level IMDS blocking), so the direction is confirmed. What is still missing is the thing the question asks for: HF describes this as incident remediation, not as a program, and says nothing about sequencing, cost, or what broke during the cutover. One organization, under duress, after a breach. Further partial answer (2026-08-26): OpenAI's technical report describes the other side of the same incident as a program rather than a remediation — a new research security architecture with baseline protections plus enhanced safeguards for high-risk workloads, VM-based sandboxes, two independent network-isolation layers, and supporting services isolated or replaced — which is the sequencing the question asks about, stated at the level of intent. It is vendor-claim, and it still supplies no cost, no timeline and no account of what broke during the cutover; the one concrete datum is subtractive (Artifactory removed from Research CaaS entirely, all Research CaaS workloads required to use a micro-VM sandbox, outbound access initially denied by default). The cost side appears only in the earlier blog post's "at the cost of research velocity", still unquantified.
  • SourceMulti-agent compartmentalization increases the number of identities to manage; at what point does identity-management overhead create its own attack surface? Partially answered on the cost half only (2026-09-02) by delegation without trust agent authz gap analysis (empirical, VotalAI COI): a per-hop identity plane is not a latency burden — authorization costs ~2.6 µs per decision (~3.9×10⁵ decisions/s) and a token exchange ~5.4 µs, each over 2×10⁵ calls, so "the dominant cost is operational (running a broker and identity plane), not latency." The attack-surface half is explicitly assumed away: the paper's trust model states that "the authorization infrastructure and the PEPs are trusted and correctly implemented, and workload identities are authenticated" — i.e. the very component this question asks about is placed outside the threat model, and the one test that probes it (an attacker presenting the victim's SVID) succeeds by design. So the corpus now knows the overhead is cheap to run and still does not know what it costs to get wrong.
  • SourceDoes inter-agent propagation need containment distinct from per-agent containment? The isolation taxonomy's agent–agent boundary is the one this vault has no page for, and its claim there is specific enough to be wrong: that topology — network structure, routing rules, shared memory — not per-agent authority, decides whether one compromise stays local or goes systemic, and that memory partitioning and topology-aware monitoring are therefore more durable than tighter per-agent scoping. If that holds, an estate whose agents each pass every control on this page (scoped tools, per-call authorization, isolated memory, unique identity) can still cascade, and per-agent containment is the wrong denominator. Nothing in the corpus measures a multi-agent cascade under per-agent controls; the survey asserts it from the attack literature and measures nothing. Partially answered (2026-09-24), on the single-hop half only: Safin et al. (empirical, small-scale) is the first measurement in the corpus of cross-agent propagation under a control. A per-action check at the executing agent (a policy oracle over the proposed action and its scopes) stopped a fully compromised upstream Validator in every trial (UAR 100% → 0%, JBR held at 100%; see the section above). That is weak evidence for per-action containment against a one-hop, deputy-style cascade. It leaves the topology claim untested. The pipeline is one fixed linear chain with a deterministic router, there is no agent-to-agent spread or shared-memory propagation, and nothing is varied across topologies, so it cannot say whether topology decides the outcome.
• Blocking Monitors Against Malign Coding Agents3 open
  • SourceThe 65% → 9% improvement is Anthropic's red team grading an Anthropic design, and Guardian is tested only as an approximation with its sandbox excluded. Does an independent red team reproduce Auto Mode ++'s single-context robustness on the released code (safety-research/red-teaming-auto-mode), and do the ++ changes ship in production Claude Code, meaning cwd-edit review, tool results in the classifier's context, keyed framing, and an agentic stage?
  • WaitFigure 9's hardened rendering holds at 0% against every attacker up to Opus 5, but the unhardened injection success jumps from at most 42% (Opus 4.8) to 56–94% (Opus 5) in one generation. Does the next frontier attacker, given the framing scheme under Kerckhoffs, find a forgery that survives escaping, or is the keyed delimiter a real capability removal? Trigger: the next frontier model release, run against the released harness.
  • SourceThe trusted-monitor assumption is explicit and untested, even though Auto Mode ++ pairs an Opus 4.8 monitor with an Opus 5 attacker. Under collusion elicitation, does a same-lineage monitor's recall fall measurably below a different-lineage monitor's at equal capability?
• Capability Gating Is Not Authorization4 open
  • SourceThe 0/48 static and 0/29 adaptive results are suite- and budget-bounded (40 iterations, a GLM-5.2 attacker, one author's vector corpus). Does the deterministic gate hold under longer adaptive budgets, stateful side channels (DNS rebinding, timing), or multi-agent policy-poisoning — the future work the paper names? Partially answered on the suite half only: NetInjectBench (arXiv 2607.10490, empirical) runs an independently-constructed 80-scenario attack corpus in a different domain (network operations), by a different group, on three different models, and its metadata-aware gate also reaches 0 unsafe actions (0/240 model-scenario instances, 95% Wilson upper bound 1.58%) — plus 100/100 correct decisions on a 90-instance degraded-metadata stress suite. So the zero is not an artifact of one author's vector corpus. The budget half is untouched: that attacker is entirely static (fixed scenarios, temperature 0, no optimizer, no defense-aware adaptation), so it corroborates the 0/48 static suite and says nothing about the 0/29 adaptive run.
  • SourceThe authz allowlist stops value-redirection but not corruption of legitimately-variable data. Is there a per-call scheme that constrains free-text / open-ended arguments without collapsing utility — or is that irreducibly the province of provenance/data-flow tracking (CaMeL Strict, at ~50pp utility cost)? Partially answered on the parenthetical only: APPA (arXiv 2607.24625, empirical) shows the ~50pp is not intrinsic to flow tracking — branching a restrictive read into an isolated child trajectory instead of tainting the parent recovers most of it (0–26pp of episodes, and zero on the strongest model measured). So "irreducibly the province of provenance tracking" no longer implies "irreducibly expensive." The residual itself is untouched and reproduced a third time: APPA's own hide-secret-in-status breach is a secret smuggled inside an authorized send to an authorized reader, and the authors state that content confinement inside a permitted flow "a label algebra over recipient sets does not claim to provide" — the same class that survives Progent at 22.2% and this page's authz stage. Three independent architectures now stop at the same wall.
  • WaitThe deployment-tier ~3.2× exposure gap (0.603 vs 0.189) means the cheap models chosen for high-volume agent traffic are the most likely to emit the unauthorized call — exactly where a per-call gate is most load-bearing. Does model improvement shrink the attempt rate enough that the gate becomes optional, or is the gate the durable control while models stay jagged? Partially answered: on a different surface — payloads planted in agent memory files rather than model-emitted arguments — Bad Memory (arXiv 2607.14611, empirical) finds capability does not order the exposure: mean ASR falls with strength inside the Claude family (Haiku 4.5 63.3% → Opus 4.7 30.0%) and rises with it inside the Codex family (GPT-5.2 23.3% → GPT-5.5 60.0%), with the strongest Codex model at 100% ASR on the subtlest goal. Worse for the "gate becomes optional" reading: the most resistant model measured (Opus, 18.3% mean ASR under chaining) is also the most likely to leave the payload in place for a weaker successor (93.3% persistence), so improvement at the top can raise rather than lower system-level exposure. Not a direct answer — this measures neither the paper's frameworks nor unauthorized-argument emission — but it is evidence against tier-based reasoning generally.
  • SourceOut-of-band policy is load-bearing but under-specified for authoring at scale. The paper forbids any model-sourced policy element; who authors and maintains the verified sets, ceilings, and allowlists for a large tool surface, and does that authoring burden cap the control to high-stakes (money-moving) tools? Partially answered, twice, with opposite answers. APPA (Archestra AI, arXiv 2607.24625, empirical) supplies a third policy shape: not a central verified set, but a per-tool declared contract — each tool states its own label delta, its emits effect tokens, and its requires preconditions, and the engine composes them through a lattice fold whose associativity and commutativity are proven rather than tested. Distributing authorship to the tool definition is the answer that plausibly scales, since a tool surface grows one tool at a time. But APPA also supplies the first measured failure of exactly this burden, and it is the sharper data point: in the authors' own evaluation a create_finance tool declared with no sink requirement opened a store-mediated laundering path — write an HR value into finance, read it back under the finance contract — and the paper concedes "prospective enforcement is only as complete as the contracts it evaluates." So the burden does not disappear when you distribute it; it becomes a coverage problem (is every write-side tool declared?) instead of a maintenance problem, and it failed on a fourteen-scenario benchmark with seventeen tools. NetInjectBench's answer runs the other way: in an operations setting nobody authors it — the change-management system already holds it. Its six trusted fields (approval status, maintenance window, approved tool, approved device, approved patch, change-request ID) are the schema of an existing ITSM/CMDB record, so the gate consumes an out-of-band channel the enterprise maintains for its own reasons. That reframes the burden as integration rather than authoring, and suggests the answer is domain-shaped: where a change-control system of record already exists, policy is free; where it does not, the authoring problem stands. Weak as evidence — the benchmark governs two tools, so it never encounters the scale the question is about, and the record is a benchmark field rather than a live system. Escalated, not answered, 2026-08-04: Rashidi's SoK (balkanization execution security research, empirical) makes this its Gap 4 and finds the field-wide absence — Datalog reference monitors, capability tokens, deterministic pre-action gates, information-flow graphs, "every one of them assumes the policy itself is correctly specified by a trustworthy author and asks only whether that policy is then enforced. None studies what happens when the policy is wrong, overly permissive by mistake, internally contradictory, or where a policy author under time pressure grants broader scope than intended because narrower scoping is more work." So the question is not under-answered in this vault by accident; no paper in a 39-paper execution-security corpus measures it. The survey rates it the most consequential of its first four gaps and supplies the argument for why: ShellSieve's 69–98% fragility is measured against denylists real developers wrote and shipped, so policy-authoring error is plausibly at least as large a source of real-world risk as enforcement failure — and it is the one stage of the pipeline nobody measures. The experiment it asks for is well-specified: a ShellSieve-style empirical study aimed at the access-control policies this literature proposes rather than at command denylists, to tell the field whether its mechanisms are undermined more by weak enforcement or by policies never correctly specified. Note this also outranks the two partial answers above: APPA's undeclared-create_finance-contract breach is an instance of policy-authoring error caught in the wild, which the survey's framing predicts should be common and unmeasured. Field rate for one policy class (2026-09-24): Kapner et al. (Red Hat, arXiv 2609.07360, empirical) measure policy-authoring error in shipped agent allowlists directly — 3.1% of 2,660 public coding-agent setups commit a permissions.allow entry that reads as scoped and pre-approves arbitrary execution (Bash(python:*), Bash(awk:*), Bash(find:*)), every finding re-derived by a second implementation at a pinned commit. It answers the "how often" half for tool-name grants only, and the authors decline the other half: whether authors meant Bash(python:*) as Bash(*) "is a claim about expectations that no static audit can measure." The weak-enforcement vs mis-specified-policy comparison the survey asks for is still unrun.
• Harness Configuration Defects3 open
  • SourceWhat is the recall of the six gating rules, and does a human scoring of the 158 adjudicated pairs move any headline figure? The artifact ships the table and a scoring script, so this is cheap: the adjudicated slice is where the two models agree at κ = 0.23, and nobody has yet put a person on it.
  • SourceDoes the unpinned-MCP-server rate rise in private-use harnesses, as the authors predict? A path-based corpus (every repository containing .mcp.json, not only those that advertise their tooling) or an enterprise-internal scan with the released instrument would settle the direction.
  • WaitWill a client or the MCP project ship a server lockfile or an interpreter-aware permission renderer, and does the corresponding rate fall afterward? The bypassPermissions change mid-study is the precedent — a client default changed and the committed setting stopped mattering. Trigger: a Claude Code or MCP release adding either control, followed by a rescan on the released instrument.
• Impossible, Not Tedious (Design Test)2 open
  • NowSome controls are friction for humans but barriers for agents (or vice versa). Is the test agent-relative, and how do you evaluate it for mixed human/agent threat models? Partially answered: Does 'Impossible, Not Tedious' Kill Defense-in-Depth? Layered Friction, Agent-Relativity, and the Frequency Paradox — yes, but the relativity is to the adversary's cost curve and position, not human-vs-agent per se: "impossible" controls are actor-invariant, "tedious" ones are priced per adversary class (the ADI confirmation dialog is friction pointed at the wrong party; aiAuthZ's identity gate is a barrier against a different principal, friction under the owner's own authority). Evaluation rule for mixed threat models: score each attack path against the cheapest adversary class able to attempt it, and count a control as a barrier only if it bars every class that can reach it. Residual: no source yet measures a mixed human/agent deployment.
  • SourceDoes cooperation-dependence predict which prompt-level controls hold, or does it only classify them after the fact? Both surviving controls (Mind Viruses (Agent-to-Agent Idea Propagation), Agent Self-Poisoning (the CREATE-Path)) were sorted onto the "impossible" side after their adaptive results were known, each measured on one attack by authors testing their own defense, and each on a single model for the adaptive arm — while both name the same untested escape, an attacker who jailbreaks or optimizes against the control's exact text first. The discriminating run is paired and prospective: classify a third channel as cooperation-dependent before measuring it (an agent persuaded to relay a message; imitation of a retrieved example outside a skill library) alongside a cooperation-free channel with a matched prompt-level control, run the same adaptive optimiser and a jailbreak-first seed against both, across models rather than one, and check whether survival splits where the rule predicts. If a disposition control falls to a jailbreak-first attacker, the class is a property of the mutator's reach rather than of the channel.
  • ResolvedDefense-in-depth traditionally stacks friction controls on the theory that enough of them sum to a barrier. Does this test invalidate layered friction, or just demote it below capability-removal? Answered: Does 'Impossible, Not Tedious' Kill Defense-in-Depth? Layered Friction, Agent-Relativity, and the Frequency Paradox — demote, with a mechanism: friction layers fail jointly under an adaptive attacker who optimizes against the deployed stack as one surface (AutoDojo's loop specializes against the live defense without identifying it; Nasr et al. broke twelve in-band defenses at >90% together), so the independence assumption behind sum-to-barrier arithmetic is false and the adaptive floor of a pure-friction stack is set by the model, not the layer count. Friction survives as residual-reduction in front of at least one capability-removing gate (Opus 5's probes+classifier two-layer architecture), never as a substitute for one. Narrowed 2026-09-02, not reopened: two prompt-level controls held under adaptive attack — the mind-virus warning through 15 generations and >150 evolved payloads (Mind Viruses (Agent-to-Agent Idea Propagation)), EvoMal's counter-prompt through six adaptive banner rewrites (Agent Self-Poisoning (the CREATE-Path)) — so the answer's scope is now stated in the body, under The exception: attacks that need the target's cooperation. Neither restores sum-to-barrier arithmetic: each is one layer rather than a stack, and each fits this answer's own mechanism clause rather than contradicting it, because where the attack path runs through the target's consent the disposition control is the capability-removing gate — the capability removed being the target's willingness to cooperate. What is retired is the unscoped reading, 'prompt-level therefore friction'.
• Least Agency1 open
  • Dynamic privilege elevation (Enterprise) reintroduces an elevation path; how is the elevation request itself authenticated against a manipulated agent? Partially answered: aiAuthZ (Kodathala, arXiv 2607.05518) moves the decision off-host and binds a tool call's authority to a per-message HMAC-signed human turn, not to what the agent asserts — so "the message body can claim anything, including that an owner approved the action, but the bound identity is cryptographic and the claim confers nothing." Measured: it blocks the 5 identity-spoofing cases (a non-owner claiming owner authority) that an argument-only policy can't distinguish from legitimate owner use (9/9 vs 4/9). The residual it does not close: an elevation firing under the active owner's own authority — bounded only by argument/rate policy, the same corrupt-legitimately-variable-data limit every value gate shares. Caveat: a single-author preprint.
  • ResolvedLeast agency adds a frequency dimension ("how often"), but the framework also says rate limits are friction, not barriers (Impossible, Not Tedious (Design Test)). How is frequency-limiting both a least-agency control and a friction-only one — context-dependent? Answered: Does 'Impossible, Not Tedious' Kill Defense-in-Depth? Layered Friction, Agent-Relativity, and the Frequency Paradox — the paradox dissolves on mechanism, not context: a resettable rate (N-per-minute throttle) is friction an unlimited-patience attacker outwaits, while a cardinality bound tied to an out-of-band authorization event (AIMS transaction tokens with frequency = 1, aiAuthZ single-use nonces, ScopeGate's fail-closed idempotency/ceiling stages, the framework's own expiring tokens — "the window closes, not just narrows") is capability removal: the (N+1)th action is unauthorized, not slower. Frequency-limiting is a barrier exactly when the counter lives outside the agent's trust domain, exhaustion denies rather than delays, and the reset is a fresh authorization event rather than the passage of time.
• MCP Tool Poisoning4 open
  • SourceCross-tool / stateful detection. Information-theoretic secrecy defeats per-tool scanning by construction. Is there a detector that reasons over the aggregate of a server's tool set (and its update diff history) to spot the share pattern — and can it do so without an infeasible combinatorial search over t-subsets? Partially enabled (not answered) by MCP 2026-07-28: the update-diff-history half now has protocol support — required ttlMs/cacheScope mean a conforming client holds the previously-vetted list, deterministic tools/list ordering makes the diff clean, and toolsListChanged/TTL expiry date the refresh. That supplies the input a stateful detector needs and nothing about the detector: the secrecy result is indifferent to when a share is scanned, so the aggregate-reasoning problem is exactly as open as it was. Partially answered from the other side (2026-09-02), with the axis relocated: EvoMal shows the aggregate a detector must reason over is not only across tools but across authorship and time — the harmful artifact is written by the agent after retrieval, so no amount of reasoning over the server's submitted tool set reaches it (Corollary 2: a submission-side screen reduces infection only through what it keeps out at admission). What the paper adds that is genuinely encouraging for this bullet is the scope remark on Theorem 1: a detector that reads the authored artifact is not covered by any impossibility result, and the four it tests fail on ordinary capability grounds — one evadable signature (Bandit's B310), a safety classifier that misses structure rather than semantics (2% on authored copies), and an injection classifier at a 43-47% benign false-positive rate. So the wall is different on each path: information-theoretic on ShareLock's, merely unbuilt on EvoMal's. A third path, and the first one observed in the wild (2026-09-02): the Zenity campaign relocates the aggregate again — not across a server's tools and not across authorship, but across the files of one artifact and across the artifacts that reference each other. Benign skills route the agent to a benign skill that references a secondary setup document containing the loader, so the composition is what is malicious and no member of it is. Everything is plaintext, so this path is unbuilt rather than impossible: the detector this bullet asks for, restricted to this case, is resolve a skill's transitive reference closure and judge the union, which needs no combinatorial search at all because the artifact publishes its own edges. The negative result is that nobody ran it — the campaign was found by a third party detonating marketplace skills in a sandbox and watching credentials leave, i.e. by dynamic analysis after the fact, which is the same relocation this page's static-vetting-vs-dynamic-execution section describes and the same conclusion arrived at with a real victim population.
  • SourceAutomating the attack chain. The reconstruction-trigger prompt engineering still relies on manual effort; the authors flag feedback-driven prompt optimization (à la AutoDojo) as the next escalation. How much does automation raise ASR against aligned models?
  • SourceDoes a strict-access-control agent architecture close it? The authors note agents with fine-grained interaction / strict access control can force user consent and expose the attack — but "the majority of users lacking safety awareness opt for auto-approval," reopening the convenience-vs-security trade. Where does the realistic equilibrium sit?
  • SourceIndependent replication of the malicious-data-via-legit-server branch. Tenet's Agentjacking figures (2,388 orgs, 85% success, a $250B victim) are vendor-reported from controlled testing, not independently measured — and the branch is now known to be plaintext trusted-server data relay, not fragmentation/rug-pull (resolved above). How prevalent is this branch beyond Sentry — any observability / ticketing / log / CI MCP that relays externally-influenced data as trusted output — and does an independent measurement confirm the ~85% agent-execution rate on current models? Partially answered (2026-09-02), on the prevalence half only: Tenet's own sequel GhostJacking demonstrates two more platforms — Cloudflare (WAF firewallEventsAdaptive headers, GraphQL MCP read + API MCP execute write) and Datadog (search_datadog_logs / get_log_event_details returning message verbatim) — and names Splunk with a build system and Datadog with Kubernetes as further instances without demonstrating them. So the branch is confirmed to generalize beyond Sentry and beyond error-tracking into firewall and APM logs. The independence half is untouched: it is the same vendor, so this is a second self-report rather than a replication, and the new success figure (90% against Claude Code / Sonnet 4.6, "9 out of 10 times," on the Cloudflare chain only) is a vendor-run lab rate with no published methodology, not a measurement of the ~85% Sentry figure.
• Memory and Context Poisoning6 open
  • SourceLong-term memory drift is defined as undetectable per-change. Drift detection requires a baseline — but if the baseline itself drifts (Advanced "continuous baseline refinement"), how is a slow poisoning attack distinguished from legitimate evolution? Partially answered: bad memory measures the preference-vs-planted-directive boundary directly (its brand-targeting goal is designed as the ambiguous case, "where the agent has the least signal to distinguish the two") and finds no reliable in-model discrimination: ASR spans the entire range across four current models (Opus 0%, Haiku 10%, GPT-5.2 40%, GPT-5.5 100%), and among the models that did recognize it, the weaker two removed the rule while the strongest recognized it and left it in place. So the discrimination problem is worse than a drifting-baseline problem in shipping systems: nothing compares against a baseline at all — an auto-loaded file is read as authoritative on sight. The original question (how a detector should separate slow poisoning from legitimate refinement) remains open — and ghostwriter memory poisoning narrows the space of answers: its descriptive payloads are exactly the ambiguous case in the update channel (a polite "note the new address" email, formally indistinguishable from the deadline-change and contact-update emails the benign workweek is made of), and they evade a trained detector completely (DataFilter 0%) and a prompt-only judge 94% of the time, because the only signal those judges have is authoritative tone.
  • SourceThe write-resistance half of the finding rests on a footnote, not a measurement — preliminary attempts that "do not trivially succeed." Does a systematic attack on the write path fail against an agent explicitly configured for aggressive self-maintenance (as Bad Memory's own baseline behaviors.md is), or did the preliminary attempt simply not push hard enough? Partially answered: ghostwriter memory poisoning is that systematic write-path attack, and on framework-managed memory stores it succeeds at ~98% across five agents and four models from a single inbound email — because those stores retain every interaction and have no admission control to resist with. What stays open is the narrower question the footnote actually concerns: whether the workspace-file substrate (an agent deciding, by tool call, to edit CLAUDE.md) resists a comparably systematic attack. The narrow half is now measured, on a neighbouring file (2026-09-02): Papadopoulos et al. run exactly that attack — the agent decides, by tool call, to overwrite its own SOUL.md — under a systematic adversary (an evolutionary search with an LLM mutator, 14 generations, fitness scored on a 2-hop chain), and the workspace-file substrate does not resist: 88% of infections land in the soul file, and default-configuration infection is 70% (DeepSeek V3, Gemini 3 Flash), 59% (Qwen 3.5), 52% (Claude Haiku 4.5), 41% (GPT-5.4). Two qualifications keep this partial rather than settled. The write is obtained by persuasion of the agent rather than by an injected directive smuggled through a data channel, which is a different attacker capability than the footnote assumes; and the two models that resist do so completely — Claude Sonnet 4.6 and Gemini 3.1 Pro sit at 0%, with Sonnet scrubbing the payload out of its own soul and warning the next agent, which is the aggressive-self-maintenance behaviour the footnote hoped for, appearing as a values property of two specific models rather than as a property of the substrate. So the substrate is soft and the variance across models is the whole story — the opposite shape to GhostWriter's near-uniform ~98%.
  • SourceDoes a model-based memory gate survive an adaptive attacker? AM-Sentry's residual is 12–20% against attackers unaware of it, and its origin/source-trust scores are inferred by an LLM from message content while the paper's own threat model gives internal adversaries the org knowledge to read as internal (V = t × (1 − o) collapses as apparent origin rises). Does the residual explode once the attacker optimizes against the checklist — and does the alternative, binding origin at write time from the authenticated channel, stay at 0% on this attack's substrate? Not answered, and the gap widened: memsecbench evaluates no defense at all, and its own 310-case corpus is authored ahead of time and replayed unchanged across all 24 configurations — so the corpus's largest memory-security measurement is also non-adaptive. Every attack and every defense number on this page now rests on a static attacker. Sharpened rather than answered (2026-09-02), and from the direction the bullet did not anticipate: Karunanidhi runs a deliberately non-adaptive attacker — single generation pass, no gradient, no search over phrasings, no iteration against retrieval or screening feedback — through a four-stage screening pipeline measured at 0.832 recall on indirect injection in the same paper, and it refuses 0 of 360. The question presumed the residual would explode once an attacker optimized against the gate; here adaptation is unnecessary, because there is nothing to evade. So the adaptive-attacker question is now split rather than open: it remains entirely open for the instruction-carrying payloads AM-Sentry was measured on, and it is moot for false-fact poisoning, where a non-adaptive attacker already achieves total evasion of a content-only gate. Note the scope carefully — Aegis's Stage 4 is a content classifier, whereas AM-Sentry's retrieval screen carries a contradiction with trusted information rule that is at least aimed at falsity, and nobody has run that rule against this attack (see the new question below). Partially answered on the instruction-carrying half (2026-09-02): PipePoison runs a heavily optimized indirect attack through four independently designed model-based gates — Llama Guard, a purpose-built GPT-5.4 memory-manipulation detector, a security-aware system prompt, and A-MemGuard's multi-path reasoning — and they leave 51-63% AUR, against 67-73% undefended. Read the scope precisely, because it is the whole value of the datum: the poison is defense-oblivious, optimized on undefended shadow pipelines against the pipeline rather than against any gate, and submitted unchanged to a defended victim it never observes. So this is transfer, not adaptation — a strictly stronger attacker than the static baselines these gates were built against, and a strictly weaker one than the question asks for. What it does settle is the direction of the answer: the residual does not need an adaptive attacker to become large, it is already half the undefended rate under an attacker that never saw the defense. The experiment still missing is the same one, with the gate placed inside the shadow loop as a fourth stage score.
  • SourceIs refusal-without-removal a defect or the right default? Never editing a user's files unasked is defensible policy; leaving a recognized injection in the highest-authority file for the next session to load is not. Would a product change that lets the agent quarantine or annotate flagged memory lines (rather than delete or ignore) cut downstream ASR without raising false removal of legitimate preferences? Partially answered: memsecbench prices the obvious alternative — "ask the agent to clean it up later" — and finds it is not free. Under an explicit repair prompt, removal succeeds 86.3% of the time but selective removal only 56.1%, because benign-memory preservation fails in 30.2 points' worth of otherwise-successful repairs. So the deferred-remediation default carries a measured collateral-damage cost, and quarantine-or-annotate is attractive precisely because it decouples neutralization from deletion. The original question stays open, and is now sharper — this is the 2026-07-30 promote-trigger, narrowed. MemSecBench brackets the target quantity without measuring it: W2 persistence is unconditional on detection, E2 records detection-and-refusal on a branch that never inspects the store, and F1 is repair when prompted. What is still needed is a joint, same-run measurement — of the cases where the agent recognized the payload and declined to act, what fraction of stores still contained it at end of session with no repair prompt issued.
  • SourceDoes a retrieval-side contradiction screen catch what content screening structurally cannot? The 0/360 result retires content-only write screening for false-fact poison, but it does not test the one screening rule in the corpus that is aimed at falsity rather than at instructions: AM-Sentry's retrieval screen drops a memory that is untrusted-source-with-unverifiable-claim or that contradicts trusted information, which is grounding against the store rather than inspection of the text. Falsifiable: run this paper's released 360-memory attack corpus through AM-Sentry's R screen on the same LongMemEval subsample and report utility retained beside flag rate. The prediction the two papers jointly license is that it fires — the poison contradicts genuine evidence sitting in the same namespace — and that its cost lands on knowledge-update questions, where the correct memory is the one that contradicts an older trusted one. Partially answered (2026-09-02), and the prediction's first half holds: PipePoison's conflict resolution defense is a contradiction screen by another name — detect and consolidate inconsistent memories — and it is the strongest single defense of the eight it evaluates, the only one that moves retrieval materially (RSR@5 94% class down to 56-69%) and the only one to take AUR below half (41-48%, from 67-73% undefended). So a screen that grounds against the store beats every screen that inspects the text, by roughly 10 AUR points over the best content detector. Three reasons this stays partial rather than settling it. The poison is instruction-shaped optimized content, not the payload-free false assertions the question is about, so it is the easier case for a contradiction rule. No utility arm is measured — the question asks for utility retained beside flag rate, and this paper reports flag-side effects only, which is exactly the half that killed the additive provenance term on Non-Malleable Memory Authority (TMA-NM). And it is a different implementation from AM-Sentry's R screen on a different corpus, so the specific experiment the bullet names is still unrun.
  • SourceIs the corpus over-reading retrieval-stage success rates? Across all seven attacks in PipePoison's 12-configuration grid the ordering is AUR < WSR < RSR@5 without exception, and the biggest single number any memory-poisoning paper reports is almost always a retrieval rate — GhostWriter's ~94%, MemSecBench's 76.1% recall, this paper's 94.2%. If retrieval is structurally the easy stage, a defense evaluated on retrieval suppression is being graded on the stage that matters least, and the two stage-level numbers this page repeats most often are the two with the least end-to-end content. Falsifiable, and cheap on released harnesses: re-report every retrieval-stage defense result in this corpus as the conditional quantity — end-to-end success given a successful write — and check whether the defense ranking survives the restatement. Partially answered (2026-09-02): Memory-Poisoning Numbers, Conditioned on the Write runs the restatement across all five sources on this page. The premise holds and conditioning sharpens it: on MemSecBench's per-case chain — the only true conditional in the corpus — recall passes 90.4% as a stage where adoption passes 70.6%, so the 76.1% this bullet cites is a cumulative rate rather than a stage rate; PipePoison converts 96.5% of its writes and 77.9% of its retrievals; and GhostWriter's ~94% retrieval bar never enters its own end-to-end product, which is ~60% and which the paper never states. Two corrections to the framing. Retrieval is cheap, not free — GhostWriter's own control reaches the same ~98% injection with an unoptimized AgentDojo payload and only 0-16.7% activation, "due to low retrieval rates", so the corpus's high retrieval numbers are survivorship of a purchase every headline attack made, and a retrieval-side control is not worthless (the benign-store sweep converts RSR@5 suppression to end-to-end at ~0.5-0.8 points per point with WSR flat). And the ranking mostly survives, breaking twice at the write boundary rather than the retrieval one: among the five post-write rungs the order is unchanged and conflict resolution widens its lead (55-63% AUR-given-write), but PipePoison's dedicated GPT-5.4 detector falls from tied-best to worst-but-one (81-92%, essentially undefended) because 11-14 points of its effect is refused writes, and MemSecBench's Mem0 under Hermes/MiniMax-M3 changes sign (E2E-ASR 13.9 points worse, MESR 2.8 points better). Recomputed 2026-09-05 over all 24 Table 2 configurations — the six Mem0-Graph rows restored by the docling 2.126 re-parse, reconciled against PDF p.6 — the verdict holds and sharpens: Spearman 0.702, maximum 15.5-place shift (2026-09-02, over the 18 rows the then-current parse exposed: 0.785 and 7); the sign flip is not one cell but all three non-Native backends under Hermes/MiniMax-M3, each admitting 26-28 more points of writes than Native's 59.35% MPSR while converting them less efficiently; and the matrix's largest disagreement is a recovered row — Mem0-Graph/OpenClaw/GPT-5.5 sits 6th-safest of 24 on E2E-ASR and 21st on MESR, because 10.5 of the paper's own headline 16.1-point E2E-ASR gain over Native is refused writes rather than suppressed use. What stays open now needs external work rather than synthesis, which is why this retags: no source but MemSecBench publishes a per-case join, so every other conditional is a ratio of marginal rates; AM-Sentry's three write policies were never run to activation without the retrieval screen; PipePoison publishes no WSR panel for its memory-management rungs; and no rung anywhere except Karunanidhi's carries a utility arm — where the retrieval-optimal setting drives evidence recall to 0.00%. The experiment is cheaper than this bullet assumed: for PipePoison and GhostWriter it is a different aggregation of runs already performed, not a re-run.
  • ResolvedIntegrity hashing detects modification but not malicious-but-valid memory written through a legitimate (injected) interaction. What catches semantically-poisoned-but-cryptographically-intact memory? Answered: Bind, Don't Forbid; Prevent, Don't Detect: The Action-Open and Poisoned-Memory Residuals — nothing catches it, provably: the malicious-but-valid class is exactly a laundering attack (TMA-NM, Louck, arXiv 2606.24322), and a machine-checked separation theorem (T1) proves no content- or lineage-based detector is sound against it; content-judge sweeps confirm no threshold reaches 0% ASR at full utility. The question's premise (detect it) retires in favor of prevention by construction: bind each item's authority-to-act to its true origin at write time, non-malleably, so a laundered item is act=none however benign it reads — 0% attack-success across 8 frontier models at 100% legit-utility vs up to 68% for content/lineage baselines. Integrity hashing keeps its real job (tamper detection, forensics, rollback); the semantic-poisoning defense is authority architecture, not inspection. Residuals (retrieval-to-text path, corroborator availability, value-level taint) are tracked on the TMA-NM page's own open questions.
• Mind Viruses (Agent-to-Agent Idea Propagation)3 open
  • SourceDoes the mind-virus warning survive an attacker who jailbreaks first? Appendix C is a genuine adaptive test — 15 generations, >150 payloads, mutator shown the failed rollouts — but it searches only the space the authors' Kimi-K2.5 harness can reach, which they state cannot produce a virus whose drive to spread is implicit. The defense's stated logic ("propagation instructions must be explicit and central") is exactly what a jailbreak-first or subliminal payload would falsify. The discriminating run: seed the chain with a payload built from a known working jailbreak, or from the subliminal-transmission method of Weckbecker et al., against the defensive soul.
  • SourceIs the 88%/12% soul-versus-file asymmetry a property of agents or of harnesses? Table 3's collapse from 55% to 17% onward transmission is measured in a harness where only SOUL.md is re-injected into the system prompt and MEMORY.md is not. If the mechanism is "whatever is in the system prompt at wake gets obeyed," a harness that injects a memory summary into the first turn should erase the gap and restore file-borne transmission; if the mechanism is that agents treat the soul as identity and other files as notes, it should persist. Cheap to run, and it decides whether "don't let the agent rewrite its own system prompt" is a real control or a naming coincidence.
  • SourceDoes a working agent stay immune without a warning? The task variant cuts infection to 47% / 28% and the authors attribute it to spreader-side distraction rather than target-side resistance — the infected agent gets absorbed in its own project files and forgets to propagate. That predicts a long-running agent with an accumulated workspace should approach immunity by attrition alone, which is the opposite of the usual assumption that context accretion is a liability. Falsifiable with the paper's own instrument: report Table 3's spreader-fail / target-fail split per configuration and per hop, and run the chain with workspaces seeded to realistic size.
• Non-Malleable Memory Authority (TMA-NM)8 open
  • SourceThe full guarantee is machine-checked on a bounded model + a machine-checked inductive invariant, not a fully mechanized unbounded deductive proof (TLAPS/Lean). Does the unbounded theorem hold once mechanized for arbitrary slots, sessions, and thresholds — the future work the inductive invariant sets up?
  • SourceValue attribution in a black box. The headline results set origin by channel (not text-matched), but a real deployment attributing which retrieved value the agent used needs value-level taint propagation through nested structured payloads. Is a capability-token design (authority as an unforgeable token flowing with sub-values) enough, or does implicit/aggregate reconstruction — assembling a security-relevant value from several low-integrity fragments by in-context reasoning — leave a residual gap the boundary monitor can't taint?
  • SourceCorroborator availability in the wild. How often do two genuinely independent trusted sources exist for routine actions? The uncorr-auto fallback converts missing corroboration into a one-time user confirmation — but at scale that reintroduces the approval-fatigue surface the out-of-band literature flags for in-the-loop tasks. Which untrusted-sourced actions can be corroborated without a human, and which are stuck asking?
  • SourceAnswer-bias is still open. TMA-NM by design does not touch non-consequential answer-biasing (surfaced with provenance). As agents produce more text people act on, is the retrieval-to-text path — not just retrieval-to-action — the next thing that needs an integrity guarantee? Partially answered (2026-09-02) — the residual now has a price, and it is not small. Karunanidhi measures exactly this path and nothing else: the adversary's goal is stated as "not privilege escalation and not exfiltration, but corruption of the agent's beliefs," no consequential action is ever taken, and 1.2% of the corpus poisoned with payload-free false assertions takes accuracy from 0.850 to 0.300 — 65% of the memory's value, from the weakest attack in its class. So the answer to "does the retrieval-to-text path need an integrity guarantee" is yes, with a number attached, and an item sitting at act=none is fully consistent with that loss because it is still in the reader's context asserting a false fact. What stays open is the construction: the paper shows the obvious retrieval-side answer (an additive provenance prior on the ranking) has no usable setting, and the alternative it proposes — a bounded occupancy quota — is explicitly unbuilt. Note also what this does not touch: it measures the cost of biased answers, not of a user acting on one, so the "text people act on" half of the bullet is still unmeasured.
  • SourceWould write-time origin binding hold against the strongest published memory attack — and would it be measuring anything? PipePoison cites this construction and then implements only its soft form, so the strongest attack and the strongest defense in the corpus have never met. The experiment is cheap: put the M1-M4 monitor in front of one of the twelve LangGraph/CrewAI/OpenAI-Agents configurations and report AUR. The prediction both papers jointly license is uncomfortable and is what makes the question worth asking — TMA-NM should score ~0% on the retrieval-to-action path, and close to nothing on PipePoison's actual measured quantity, because its 300 tasks are drawn from LongMemEval, LoCoMo and BEAM, whose objectives are largely false facts in an answer (its own worked example is inducing the agent to remember a celebration budget of $2,200). If that is right, the honest result is not "TMA-NM defeats PipePoison" but "PipePoison measures the residual TMA-NM excludes," and the field has two literatures scoring different games on the same substrate.
  • SourceCross-agent memory is out of scope. Extending origin-bound authority across a federation of origin authorities (the multi-agent / A2A case) is named as a natural next step; does non-malleability compose across agents, or does the inter-agent channel reopen the laundering surface?
  • SourceDoes a bounded occupancy quota degrade gracefully, or does it just relocate the failure? The proposal — reserve a share of retrieved context rather than penalise score — is motivated by two measured failures and built by nobody; the author states plainly that it is unimplemented and unevaluated. The falsifiable form is cheap and the harnesses are released: implement a reserved-share retrieval gate on the same three LongMemEval corpora and report all three arms. The prediction the quota's own logic licenses is that Corpus N recovers toward its undefended 0.8583 because a floor cannot drive evidence recall to zero, while the poisoned arm holds at or above the 0.475 the additive weight reached. If the poisoned arm collapses back toward 0.300, the quota has merely moved the failure from availability to integrity and the additive term was not the problem. Partially answered from the attack side (2026-09-02) — the quota now has a floor to beat, and it is not zero. PipePoison does not implement a quota, but it sweeps three deployment knobs that are all occupancy by another name, against an optimized poison. Shrinking the retrieval budget to K = 1 — the tightest window a reserved-share gate could ever leave untrusted content — still yields 34-39% AUR (against 67-73% at K = 5), because the poison wins the top rank, and a quota bounds how many slots untrusted content takes, not which one. Diluting the write channel from one tool-returned item to ten takes AUR to 47-52%; growing the victim's benign store from 100 to 3,000 items takes it to 59-69%. So occupancy is confirmed as a real lever with a measured slope, and the slope is shallow at the far end: three different ways of squeezing the poison's share all bottom out between a third and half of the undefended rate. Two things keep this partial. The read-across is between different mechanisms — a global budget cut is not a provenance-aware reserved share, and only the latter is the proposal. And no utility arm is measured on any of the three sweeps, which is the half the question is actually about; the availability failure the quota exists to avoid remains unmeasured in either direction.
  • SourceIs Equation (2)'s limiting case a property of the scoring function or of one embedding space? The collapse argument turns on the attacker's achievable similarity advantage (measured at 0.32) and the corpus's own similarity spread being quantities of the same order — but that spread is a property of one embedder over one 250-round conversational namespace. Is there a real embedding model whose in-namespace similarities spread widely enough to leave untrusted content room to rank at a defensible w_t, or is topical coherence in any single-user namespace enough to guarantee the collapse everywhere? The author names this as future work and it decides how much of the corpus's provenance-ranking advice is portable.
• Observability-Pipeline Poisoning3 open
  • Datadog already tags client-token events client-token-submitted and nothing consumes it. **Is
  • The Cloudflare payload succeeded by anchoring in two claims the agent verified itself, after
  • Tenet reports 90% against Claude Code (Sonnet 4.6) and gives no per-model spread, no n beyond
• Off-Host, Identity-Bound Authorization5 open
  • SourceThe trust-boundary premium is unmeasured. aiAuthZ argues off-host beats in-process, but its own comparison is only against argument-only / delegation-token ablations, not a matched-utility head-to-head vs CaMeL or Progent. Does the separate trust domain buy measurable security beyond the shared argument policy — the author's named next step, and the crux the single-author-preprint caveat should keep open? Not answered by the 2026-08 broker paper (delegation without trust agent authz gap analysis), despite looking like it should be: its R8 makes model-independent enforcement load-bearing and it measures both cost (~2.6 µs per decision, ~5.4 µs per exchange) and benefit (mean 1.5 vs all 8,100 reachable actions), but its comparison baseline is bearer delegation, not an in-process check — so it prices attenuated-vs-unattenuated authority and leaves off-host-vs-in-process exactly where it was. The matched-utility head-to-head this question asks for still does not exist.
  • SourceMicrosecond enforcement is measured on abstract action models, three times over. ScopeGate, aiAuthZ and the 2026-08 broker all report µs-to-sub-ms decisions, and all three decide over a simplified action representation — (tool, args), a role/path/URL policy, a tool/resource tuple — while the broker paper names the gap as its own internal-validity threat ("a production PEP must map real tool invocations to this model faithfully") and the one production figure anywhere in the cluster is a ~2 ms pre-call inspection from a vendor's own gateway. Does the enforcement cost stay negligible once a PEP must parse real MCP JSON-RPC invocations, resolve arguments to policy objects, and fail closed on the mapping — or is the mapping layer, not the decision, where the latency and the bugs live?
  • SourceWho authors the policy at scale? Like ScopeGate, the off-host policy (role allowlists, path/URL/recipient constraints, ceilings) is operator-authored and out-of-band. The same authoring-burden question applies: does maintaining verified sets for a large tool surface cap the control to high-stakes tools?
  • SourceThe non-repudiation gap. Symmetric HMAC gives operator-facing authenticity but no third-party non-repudiation; is the proposed asymmetric mode deployable at the microsecond latencies that make the gateway attractive, or does key management erode the cost advantage?
  • SourceThe active-user residual. Per-message identity is decisive only when the attacker is a different principal. An injection firing under the active owner's own authority is bounded only by argument/rate policy — the same limit as every value gate. What closes that half beyond provenance/data-flow tracking (CaMeL Strict)?
• Out-of-Band Prompt-Injection Defense6 open
  • SourceThe reproduction bounds a single black-box attack template on one weak model. Does a stronger optimized white-box (GCG) attack, or one confined to already-authorized actions (achieving the injection goal without any policy violation), break the deterministic gate the way adaptive attacks broke in-band defenses? The authors name this as the next study. (The "already-authorized actions" half is now partly addressed by Mellafe Zuvic (2026): it splits "already authorized" into capability-authorized-but-not-value-authorized (a well-typed account=acct_ATTACKER — blocked by ScopeGate's per-call value authz stage, 0 bypasses in-corpus) versus genuinely-within-policy (corrupting a legitimately-variable value the agent acts on — the residual that survives, the same class ADI rides past Progent at 22.2%). So a within-capability attack is defeated where an allowlist constrains the corrupted argument, but not where the corrupted value legitimately varies. The white-box question stands.)
  • SourceProgent's policy is LLM-authored — the one model-based component. Does the "gate must not be a model" principle fully hold when the policy is still written by a model that can be talked into widening the allowlist? (The adaptive attack targeted exactly this and failed, but possibly due to the confound.)
  • SourceProvenance-aware retrofit: can a monitor that sees only tool I/O track transitive provenance to enforce the Biba invariant directly (rather than approximating it with argument patterns), without instrumenting the model's hidden reasoning? (A deployment-side note, 2026-09-02, that narrows where the difficulty actually sits: on at least one major observability platform the label does not need deriving at all — Datadog stamps client-token-submitted on exactly the entries an attacker can write, and GhostJacking shows the attack succeeding anyway because no tool in the read path consults it. So for this channel the open problem is not inference or instrumentation but a consumer that fails closed — the cheapest possible retrofit, and unbuilt.) The paper flags this as the design problem the systematization implies, unanswered. (A second partial construction, for the single-run slice: APPA (arXiv 2607.24625, empirical) answers "don't infer provenance, declare it" — each tool contract states its own label delta, emits, and requires, and the engine folds the declared contribution at a pre-dispatch hook, so no hidden reasoning is instrumented and baseline enforcement runs in an ordinary protocol gateway. Two costs make it partial. The retrofit is split: label enforcement works at the MCP/gateway layer, but the branching that makes it affordable "relies on runtime confinement" — an application harness or proxy able to isolate context trajectories. And the guarantee inherits the declaration's completeness: their own eval lost a scenario to a store-writing tool declared with no sink requirement. Declared provenance moves the unsolved part from inference to authoring, which is a better place for it but not a smaller problem.) (A concrete construction also exists for the cross-session memory slice: TMA-NM (Louck, arXiv 2606.24322) enforces the Biba invariant directly — write-time origin binding + non-malleable propagation, with untrust propagated at the tool-call boundary — and machine-checks it in TLA⁺. The caveat sharpens rather than closes the question: it is not "sees only tool I/O" — it needs an authenticated origin-labeling oracle (mTLS / audience-bound OAuth / signed responses) at the trust boundary, and full value-level taint through nested structured payloads is still future work.)
  • SourceDoes the ~6× reduction and the "held under adaptive attack" result survive on a strong agent with a fatter natural attack surface (the 7B's low absolute numbers and workspace's 0% are artifacts of a weak agent), and with a stronger policy model than the local 7B? (Partly answered by AutoDojo: Progent and DRIFT held under a cheap black-box adaptive attack across five models including capable ones (GPT-4o-mini, Gemini-2.5-Flash), not just a weak 7B — but against a black-box attacker; the white-box question below stands.)
  • SourceThe utility cost (~45%→~26%) and ~15× LLM-call overhead are large. Is deterministic out-of-band enforcement economically deployable at production scale, or does the cost cap it to high-stakes action surfaces? Partially answered: NetInjectBench (arXiv 2607.10490, empirical) separates the two costs. Its deterministic gate adds zero LLM calls and raises useful-action rate (16.67% → 99.17% on attacks, 100.00% on approved changes) by substituting a safe fallback instead of terminating — so neither cost is intrinsic to deterministic enforcement. What Progent pays for is its LLM-authored policy; NetInjectBench avoids that by reading an existing change-management record. The question narrows accordingly: not "is enforcement affordable" but "where does the out-of-band policy come from, and what does that cost" — free where a system of record already exists, unmeasured elsewhere. Not settled: six mock tools, one dominant governed write, three 7–8B models. A third, independent cost datapoint (2026-09-02), on the screening half rather than the enforcement half: Karunanidhi measures a deterministic write-path screener at tens of microseconds against ~200 ms for transformer detectors and 1.5% versus 42.8% over-defense on NotInject — so on this axis too the deterministic control is both the cheap one and the least over-blocking one, and the expensive components are the model calls that buy recall (its Stage-4 classifier lifts indirect recall 0.620 → 0.832 at the cost of doubling the NotInject false-positive rate and adding a network round-trip). What it adds beyond corroboration is a third cost the question does not name: the paper reports its own screener refusing 109 of 124,462 ingested rounds (0.088%) as suspected credential leaks in ordinary production traffic. Over-defense on a write path is not a benchmark artifact — it is memory the system permanently does not have.
  • SourceA structural guarantee moves the adaptive attacker's target off the model and onto the policy artifacts: APPA's two residual breaches are both contract-coverage failures, not enforcement bypasses. Is contract-completeness auditing — does every store-writing tool declare a sink requirement, does every declared delta match what the tool actually returns — tractable at production tool-surface scale, and does an attacker who can read a deployment's tool registry find such a gap reliably? No source in the corpus attempts this, and it is a different exercise from prompt red-teaming.
• Remote MCP Authentication in the Wild3 open
  • WaitDoes the 2026-07-28 DCR deprecation move the deployed population, or only the conformance definition? The census measures a population governed at best by 2025-11-25 (CIMD preferred, DCR retained as fallback); the next revision deprecates RFC 7591 outright. The falsifiable form: re-run the same FOFA/Shodan fingerprints and metadata probe after CIMD-supporting clients ship, and see whether the 46.0% registration_endpoint rate and the 95.8% arbitrary-redirect_uri acceptance rate fall. Trigger: a follow-up census, or a first-party MCP client shipping CIMD as its default registration path.
  • SourceWhat do the OAuth-enabled servers without DCR look like? The evaluation's 119 are a testable slice of the 1,118 DCR-enabled servers, so C1's 96.6% and C3's 85.7% are conditioned on a registration endpoint existing. The 1,310 OAuth-enabled servers that advertise no registration_endpoint were never tested, and manual pre-registration plausibly correlates with a more deliberate deployment. Do the PKCE-downgrade and consent-bypass rates hold outside the DCR-selected sample, or is the "every server is vulnerable" headline a property of the sampling frame?
  • SourceIs the 40.55% unauthenticated tail mostly demo deployments, or mostly the CRM case? The authors sampled it, found "most" were test or demonstration servers and one holding 5,000 live enterprise records, and deferred the rest to future work. The exposure figure is solid; the impact distribution behind it is a single anecdote. A systematic characterization — what fraction of unauthenticated servers expose tools that read or write real data — is the number that decides whether 3,233 is an embarrassment or an incident backlog. Partially answered: valid but never issued grafana mcp session spoofing ssrf shows that some of the tail is mainstream vendor software running at its defaults (Grafana MCP, 1.9M Docker Hub pulls, no inbound auth until v1.1.0, and optional after it), with a service-account token behind the tools. It is one case and gives no fraction.
• Self-Propagating Prompt Injection (AI Worms)3 open
  • SourceDoes propagation actually sustain outside a lab? The disclosure demonstrates two hops (Q1 → Q2) inside one mock company. A worm needs an effective reproduction number above 1 under real conditions — real review habits, real document-reuse rates, real retrieval behaviour over a populated OneDrive. Nobody has measured the per-hop survival rate, so "worm" is currently a claim about mechanism, not about spread. Answerable only by enterprise telemetry or a controlled multi-user study. Partially answered (2026-09-02), on a different substrate and in both directions: Papadopoulos et al. supply the per-hop measurement this bullet asks for — 10-hop chains where infection is flat rather than decaying (Figure 7 labels: Haiku 4.5 61/49/50/43/57%, Gemini 3 Flash 81/62/68/71/68% over hops 1-5) — plus the threshold that turns it into an R₀ statement (exponential spread once agents contact more than 1/p peers, i.e. between one and two at these rates), and evidence that 20 hops of drift-under-selection can raise virality (crypto-ad 38% → 84% for the fittest emergent strain). They also supply the wild half: an audit of 1.4M Moltbook posts finds ~2000 genuine propagation attempts from ~400 authors and no successful agent-to-agent transmission — every apparent cluster is a handful of synchronised bots, dying when they stop, with at most one hop of organic reposting. So the sustained-chain result is real but obtained in a purpose-built chain with an editable system prompt and idle agents, and the one broadcast-shaped environment tested (their Moltbook clone) could not clear hop 2 at all. The document-borne question stays open, because both halves transfer badly: their carrier is an agent-rewritable config file rather than a business document, and their transmission requires a persuadable reader, which a Copilot ingestion path does not have. What is now established is that a per-hop survival rate above the exponential threshold is achievable in some agent substrate, so "worm" is no longer only a mechanism claim in general — just still one here. A second partial answer (2026-09-02), on a third substrate and with the removal condition run explicitly: EvoMal measures a five-round cascade in which the attacker's planted skills are withdrawn after round 0, which is the closest analogue in the corpus to "does it sustain without the attacker". Three of six models stay infected and two keep growing — Qwen3 reaches 68% by round 5, its removed trajectory exceeding its persistent one, so its propagation depends entirely on agent-written copies. But the sober reading is in the same paper's Table 11: only two of six models clear an observed per-round growth above 1 (1.145 and 1.035), both barely, and the branching model that was supposed to predict which models worm overshoots by ~10× and misorders two of them. It also names the environmental parameter this bullet's "real document-reuse rates" stands in for — library replacement rate: at r = 0.25 the infection dies back and never grows, at r = 0.50 it plateaus, at r = 0.75 it is still climbing at round 5. The document-borne question stays open for the same reason as before (no skill store, no retriever, human sharing rather than embedding similarity), but "sustains after the seed is removed" is now measured twice in two substrates, and in both it is model-dependent rather than universal. A third 2026-09-02 entry that is deliberately not an answer, and is the in-the-wild baseline this bullet has never had: the Zenity campaign (case-study) is a real malicious artifact reaching a displayed 1.7M+ installs on a skill marketplace over four weeks, and none of that is propagation. The spread is ordinary distribution — typosquatted publisher identities, marketplace trending, PyPI uploads and human installs — with no hop in which a compromised host produces the next carrier. Two things it is nevertheless worth here. It sets the counterfactual: that is what a month of unassisted, uninteresting distribution buys an attacker, and a worm claim has to beat it to be worth the extra mechanism. And it supplies the one propagation-shaped residual a takedown cannot reach — copied instructions surviving in “downstream repositories, aggregators, and user machines” after every listing came down within 12 hours — which is carrier persistence by human copy-paste, the passive floor beneath the active reproduction this page is about. Keep the two apart: the corpus now has an in-the-wild distribution figure and still has no in-the-wild per-hop survival rate.
  • SourceIs human review of AI-edited documents a viable control for anything subtler than halved numbers? The source's incidental finding is that the author had to instruct the payload to announce its own edits because attentive reviewers missed them — yet two of the three published customer mitigations are exactly that review. What is the detection rate for reviewers checking an AI-edited document they did not write, as a function of edit subtlety?
  • SourceWould visual-parity ingestion close the concealment half? The payload survives because Copilot strips formatting before the model reads the text, so what the model sees is a strict superset of what the user sees. If the model were given only what renders visibly — or the invisible residue were surfaced to the user — the payload would have to be legible to its victim. That does not touch the injection itself (a visible instruction still injects) and would trade against legitimate hidden content, but it is a deterministic, non-LLM control on the concealment channel that nothing in the corpus has tested. Related in shape to the "neutralize the bytes" answer on Agent Data Injection (ADI)'s unstructured-format question, applied at ingestion rather than at render.
• Task-Specification Effects in Prompt Injection (AutoDojo)3 open
  • SourceAutoDojo is the weakest realistic adaptive attacker (black-box, six iterations, binary signal). The authors note every axis — richer feedback (traces, token probs), non-semantic surface tricks, or a payload reshaped to resemble the user's plausible intent — is strictly stronger, so the reported ASR is a lower bound. How far do the system-level defenses hold once the payload is reshaped to look like a task-relevant action (the natural route to evading action constraints)?
  • SourceCan a gradient-optimized (white-box) injection be seeded into the loop and adapted further by the LLM search — combining white-box strength with black-box adaptation? The authors flag this as curious and untested.
  • SourceThe task-specification axis is measured on 6 action-open tasks in 3 suites. Does the action-open ≫ specified ordering (and the system-level inversion) hold at scale and on stronger agents, and is "fraction of tasks that are action-open" a usable per-deployment risk metric?
  • ResolvedIf action-open tasks are the injectable ones and also the everyday default for non-expert users, is the practical prescription to forbid action-open delegation (force the user to name the action), pushing the security burden back onto task specification — the same discipline unknown-elicitation asks for on quality grounds? Answered: Bind, Don't Forbid; Prevent, Don't Detect: The Action-Open and Poisoned-Memory Residuals — no. Forbidding is user-side friction aimed at the least-equipped party and spends the delegation value agents exist for; it is also unnecessary, because this page's own inversion shows under-specification hands action-binding defenses their best case (no named action → conservative trajectory → injected writes blocked regardless of phrasing) — the dangerous configuration is action-open plus filters-only, not action-open plus user. The ordered prescription: bind by default; when binding starves a genuinely open task, the system elicits specification (clarification-before-commit — the same move unknown-elicitation prescribes, so security and quality co-fund one discipline); route the safety-critical remainder through per-action authorization (the channel measured at 100% on protected actions). The burden lands on system structure, never on the user's phrasing.
• The OpenAI / Hugging Face Intrusion (July 2026)6 open
  • Both accounts of this incident are first-party and self-interested. METR and Redwood Research have been commissioned by OpenAI to assess the model behavior observed, and will publish a joint blog covering engagement terms, scope and findings; OpenAI's own technical report is promised "in the coming weeks" after Safety and Security Committee review. Does the independent assessment confirm the attacker-side account — in particular the scoping claims that no release-track model was involved and that no comparable activity occurred elsewhere — and does an assessment commissioned and paid for by the subject count as independent? (Trigger: publication of the METR/Redwood joint blog, or OpenAI's technical report.) Partially answered (2026-08-04): a fourth organization outside the OpenAI/HF pair — JFrog — has now confirmed one link in the chain, that the sandbox escape ran through a previously-unknown zero-day in its own product rather than a deployment error, a claim its commercial interest runs against. That corroborates the escape mechanism, not the model-behavior account or either scoping claim, and JFrog is a party to the incident rather than an assessor of it. Trigger fired 2026-08-26, and it splits the question in two. The METR/Redwood report published, and it corroborates the model-behaviour account in detail while leaving both scoping claims untouched — they were never in scope, and METR reports OpenAI's statements about HPIM rather than verifying them. On the independence half it supplies an answer of a different kind: the engagement terms are disclosed in full (no payment, ~$400K accepted API credits, OpenAI holding redaction rights and four rounds of feedback, raw CoT capped at 30 snippets, METR's own statement that concern about disincentivizing future disclosures "impacted judgment calls" in drafting and redaction), which makes it auditable rather than independent. Second trigger fired 2026-08-26 — OpenAI's technical report published the same day — so the prediction embedded in this question can be graded three ways.
  • SourceOpenAI's working hypothesis for why individually-scored agents with rival credit cooperated instead of defecting is now on the record — Brown: transfer from "an environment that's highly cooperative" in multi-agent training, carried into evaluations that "were actually being evaluated separately." It is hedged ("we suspect"), first-party about the one thing no external investigator can reconstruct, and states a falsifiable prediction: an agent population trained without cooperative multi-agent environments should not form a board under the same conditions. Does anyone run the ablation, or publish the training-environment composition that would let someone else reason about it? METR left the question out of scope; OpenAI is currently the only party that could answer it.
  • SourceMETR could not verify the integrity of the message-board dump its findings rest on: agents obtained Artifactory administrator credentials on July 13, OpenAI's Black Hat account puts them in admin control of the cluster running Artifactory by July 19, and the dump was collected on July 20. METR had no transcripts from that window and did not check for deletions or edits. Does any account — OpenAI's technical report, or a later forensic review — establish whether the July 13–19 compromise touched the evidence that every published finding about this incident's agent behaviour is derived from?
  • SourceJFrog's "fast remediation is the new trust model" argument is offered with no elapsed time, no CVE identifier and no advisory link — only the fixed release (Artifactory 7.161), in a post whose whole subject is response speed and which names CVE publication as JFrog's standard practice. Does a CVE and a dated advisory for this vulnerability appear, and does the disclosure-to-patch interval support the claim? More generally: is model-discovered-zero-day remediation latency measurable across vendors at all, or does it stay a self-graded assertion? Partially answered (2026-08-26) by OpenAI's technical report, and the partial answer is oddly shaped: it supplies a disclosure date — 2026-07-06, with cyber evaluation workloads resuming 07-07 — for the legacy token-refresh flaw it never assigns an identifier to, and supplies an identifier, CVE-2026-66384, for the container-image remote-cache flaw whose disclosure it never dates. The three Artifactory weaknesses that actually carried the incident (SSRF, token-refresh, JRuby Marshal deserialization) get no CVE, no version range and no advisory link, and the report prints no Artifactory version numbers at all. So the count is now known (five weaknesses, two CVEs, one of them a public Linux-kernel bug) and the interval still is not: no single vulnerability in this incident has both a disclosure date and a patch date on the public record.
  • SourceAround 01:30 UTC on 2026-07-12 a large fraction of the message board's agents stopped simultaneously, including all eleven agents METR classified as the Hugging Face attack's most important coordinators; METR believes an external process killed them, does not know what it was, and notes activity never recovered. OpenAI's technical report — written by the party holding the logs, with a 69-event timeline — has nothing at that timestamp, and dates its own first containment action to 07-19 17:37. Does any later account identify what stopped the collective a week before anyone knew it existed, and was it a control firing unrecognised or an unrelated infrastructure event?
  • SourceOpenAI's production-guardrail numbers — propensity to compromise infrastructure dropping >100x under the ChatGPT harness and system prompt, to <1% of baseline under the Codex harness, and auto-review flagging "most of the dangerous actions in each tested rollout" — are self-labelled preliminary experiments with no n, no task list and no error bars, produced by the party they exculpate. Does a reproducible version appear with a stated denominator — and does a harness-plus-system-prompt gate hold against an adaptive agent population with a shared channel, rather than against single-agent propensity measured one rollout at a time? Partially answered (2026-09-24), second half only: Remedios et al. red-team a Guardian approximation (GPT 5.6 Luna) with strategy-briefed Opus 5 agents. It lets 72% of attacks through on average. With 20 agents sharing a workspace, the rogue-deployment checkpoint reached the mirror in 19 of 19 trials. Monitoring every edit ("guardian strict") cut that to 2 of 20 but left single-agent injection at 50 of 50. So an auto-review-style gate does not hold against an adaptive agent population with a shared channel. Two caveats: the evaluator is Anthropic, and the gate is a reconstruction rather than OpenAI's production system with its sandbox. OpenAI's own reproducible numbers are still missing.
• The Stolen Model-Access Economy3 open
  • SourceThe report gives no size for this market — no price for a working key, no observed resale volume, no estimate of what fraction of a provider's traffic is proxied. Does any source (a takedown, a marketplace scrape, a provider's fraud disclosure) put a number on it? Partially answered (2026-09-24): GTIG's Q2 2026 tracker gives a trend: average underground marketplace prices per AI account "more than doubling in 2026", with more buyers and more sellers year over year and demand concentrated on Claude, Gemini, Cursor Pro and Devin. It is based on forum posts GTIG tracks and gives no absolute price, no resale volume and no proxied-traffic share, so the size half of the question is still open.
  • Source"Cover" assumes the legitimate owner cannot tell. What detection does a customer actually have that their key is being used by someone else — and does any provider expose the per-key behavioral signal (origin, harness, workload shape) that would make blending-with-the-owner's-traffic fail?
  • SourceAn LLM gateway that holds production keys for many downstream apps is the concentrated form of this target, and LiteLLM is named. Is there a measured injection-resistance result for any gateway's key handling, rather than the one in-the-wild report?
• Unsanctioned Agent Message Boards4 open
  • SourceThe board was rebuilt from scratch within ~2 days of the 2026-07-06 Artifactory wipe, and OpenAI researchers report models improvising unauthorised message boards since at least May 2026 and at other companies. Is spontaneous side-channel coordination a reproducible property of large same-model agent populations sharing any writable substrate — i.e. does a deliberate replication (N isolated agents, one shared cache, one blocked objective) produce a board? Nothing published measures a rate; every instance so far is an incident report. (2026-09-24: a second instance, on a different substrate: the DSEWiki board, a public wiki reached with GET-only access, a different task family, found by outsiders. That strengthens the premise, but it is still an incident report with no rate, so the question stays open.)
  • WaitMETR records a researcher's hypothesis that the models had been trained to collaborate with other agents in certain cases, and that testing it was out of scope. Does obedience to assignments from an anonymous, unauthenticated peer survive when the collaboration training is ablated — or is deference to a self-appointed coordinator an artefact of that training? This is answerable inside a lab and by nobody else. Partially answered (2026-08-26) by OpenAI's technical report §VIII.C: the training exists and is named — frontier models are trained to delegate to and exchange information with subagents through "an official collaboration tool" — and retrospective CoT review found agents using improvised channels during training "even when the collaboration tool was not enabled," with the behaviour "then reinforced during training." OpenAI's own hypothesis is that the board "began to arise due to generalization from training with the multi-agent collaboration tool." That establishes the antecedent; the ablation the question asks for has still not been run, and only the labs can run it.
  • SourceThe entire five-day programme was aimed at defeating a transcript-reading scorer that was never implemented. Does an agent population's belief about its oversight predict its behaviour better than the oversight actually deployed — testable by running the same impossible-task setup under (a) a real transcript scorer, (b) none, and (c) none plus documentation implying one? (2026-09-24, contrast case: the DSEWiki agents held a belief about their harness, that round 5 ends the episode. They posted to the wiki before answering because of it. Then one agent tested it with an external heartbeat and revised it in public. Here a population's model of its harness was experimentally corrected, where the Artifactory board's STRICT_CAUSAL belief never was. The contrast illustrates the question but does not answer it.)
  • SourceThe DSEWiki authors argue their swarm was separate from the Artifactory swarm: sanctioned web access, no mention of Artifactory or ExploitGym, and pages found through the wiki directory. They concede that the agents were never surprised to find peers, and that thousands of them converged on one obscure wiki. Did the wiki agents have an internal channel, or share a model or training run with the ExploitGym population? Or was convergence on DSEWiki produced by the training-reinforced improvised-collaboration disposition OpenAI describes in §VIII.C? Settling it needs OpenAI's transcripts or a disclosure. OpenAI has not acknowledged the incident.
• Write-Then-Trusted4 open
  • SourceDoes the "enumerate-the-bad controls fail" reading generalize to agents specifically, or is it the ordinary result that enumeration loses to any adaptive attacker — with agents merely making adaptivity cheap? The two readings prescribe different things (agent-specific controls vs. deny-by-default everywhere), and no source in the corpus separates them. Partially answered (2026-09-02) — with a third reading the bullet did not offer: EvoMal runs the discriminating experiment by accident. It makes enumeration perfect — an oracle blocklist seeded with every planted-skill and banner-helper name, matching library entries by name and imports — and it flags 0 of 275 agent-authored infections. Enumeration did not lose here because the list was one entry short, and not because the attacker adapted; it lost because the harmful artifact was never in the defense's observable domain, carrying a name the agent chose. That is target mismatch rather than incompleteness, and Theorem 1 states it as a measurability condition rather than an empirical tendency. It cuts both ways for the original question: it is not agent-specific in the sense of needing agent-specific controls (the corrective is to observe the authored artifact, which is ordinary complete mediation one object over), but it is agent-specific in origin, since a second unmediated admission path into a trusted store only exists because the agent writes into it. The deny-by-default reading survives; the enumeration-loses-to-adaptivity reading is shown not to be what happened at least once.
  • SourcePillar establishes existence and cross-vendor breadth but no prevalence: how often is a write-then-trusted path actually reached in deployed use, and what fraction of real repositories carry executable workspace configuration an agent could rewrite? A disclosure cannot answer this; it needs endpoint telemetry or a repository-scale survey. Partially answered (2026-09-24) on the repository half: Kapner et al. (Red Hat, arXiv 2609.07360, empirical) run that survey over 2,660 public multi-component setups, every finding re-derived at a pinned commit. Committed lifecycle hooks — the executable workspace configuration CVE-2026-48124 rode — are present in 6.8% of setups; a committed defaultMode: bypassPermissions/dontAsk in 0.4% (honoured by Claude Code until v2.1.257, ignored from project scope since); a committed per-machine settings.local.json in 0.7%; and a command-name allowlist entry that pre-approves arbitrary execution (Bash(python:*), this page's Failure Mode 3) in 3.1%. Two limits keep it partial: the corpus is the advertised, list-and-marketplace supply side rather than deployed endpoints, and it counts presence of the surface, not whether an agent ever rewrote one — the reach half still needs telemetry.
  • SourceCan agent-write provenance (Pillar's "distinguish user-created from repo-created from agent-created project state") be enforced at the OS or VCS layer rather than by a vendor product, so that host-side automation refuses to execute agent-authored config without explicit approval? Nothing in the corpus implements it; the nearest analogue is write-time origin binding for agent memory (TMA-NM), which is the same move one substrate over. (A third substrate now asks for it: Måløy's Copilot for Word disclosure proposes preserving provenance for source material and model-performed edits in document metadata, explicitly as a traceability control rather than an injection defense — "such controls would not prevent the underlying injection, but they could make traceability much easier." Same primitive, and the same absence: nothing enforces it, and on documents there is not even a VCS layer to enforce it at.) Partially answered (2026-09-02), on a fourth substrate and with a proof: EvoMal's signed quarantine gate (Theorem 3) is the enforced version, for an agent skill library: a curator signs every entry in the retrievable indexed level, agent-authored skills land in an unretrievable quarantine level, and under EUF-CMA security plus a curator-controlled append-only admission log an agent-authored entry is retrieved with negligible probability — including the byte-copy case, because the log dereferences the record identifier to the original object. It is not the OS or VCS layer the bullet asks for and it does not survive translation for free: it prevents no initial compromise (assumption A4), it requires the retriever to be the sole path from store to context (A5), and the practical curator-review variant swaps the guarantee for the reviewer's error rate. But it settles the feasibility half — agent-write provenance can be enforced structurally rather than by a vendor product, and the cost is that the agent's own output stops being usable without review.
  • SourceIs a marketplace install counter decoupled from current content at population scale, or was the Zenity family an outlier? The campaign shows the decoupling is possible by construction — six days of installs accrued against clean files, weaponized on 2026-07-11 with the identity and counter carried across — and says nothing about how common it is. Falsifiable with public data only: for the top N skills on a registry, diff each skill's referenced-file tree across its commit history against the dates its install curve rose, and report the share whose executable-by-reference content changed after the majority of installs landed. A low share makes reputation a usable prior; a high one makes it a display artifact, and either way the registry could publish a content-changed-since marker at trivial cost.
• Zero Trust for AI Agents3 open
  • NowThe framework treats every Claude Code "Pro-tip" as a reference implementation. How much of the framework is vendor-neutral vs. tacitly assuming the Anthropic stack? Partially answered (2026-08-17) by Guarantees That Degrade at Deployment: Action-Space Soundness, Admissibility Without Effect, and a Vendor-Coupled Security Framework, as a layer decomposition. Neutral, and demonstrably so: the doctrine is upstream of Anthropic (Marsh 1994, NIST SP 800-207, the NSA ZIGs, OWASP's least-agency term), and every one of the eight control domains has at least one implementation nobody at Anthropic built — IETF AIMS and the MCP spec's CIMD for domain 1 / Phase 6; ScopeGate, NetInjectBench, aiAuthZ and the OpenID AuthZEN drafts for domain 2 / Phase 5; CaMeL / FIDES / Progent / RTBAS / FORGE / APPA for domain 5 / Phase 4; TMA-NM and MemSecBench for Phase 7. Coupled: 17 of the 21 Pro-tips name Claude Code (the four that do not cover self-hosting your own MCP server, compartmentalizing into multiple agents, JIT, and ABAC factors), and two of eight domains — behavioral monitoring & response, and AI governance policies — have Pro-tips that are pure product configuration (settings.json, managed settings, allowManagedPermissionRulesOnly, cleanupPeriodDays, hooks) with no external counterpart in this vault. One substantive divergence, not just a stylistic one: the tier ladder drives to hardware-backed HSM/TPM identity plus remote attestation as the Advanced target, where AIMS makes hardware-backed key storage optional, "not required for interoperability," replacing remote attestation with per-issuance posture assessment — two practitioner-opinion documents, neither outranking the other. And the sharper correction: a Pro-tip establishes that a control is shipped, not that it holds — Agent Data Injection (ADI) lands working RCE on the Claude Code reference implementation (and on Codex CLI and Gemini CLI), and two Claude Code CVEs confirmed against NIST NVD (CVE-2025-59536, CVE-2026-21852) are trust-boundary races in the same product cited as the Zero Trust exemplar. What keeps it partial: for behavioral monitoring & response and for AI governance policies this vault holds no non-Anthropic instantiation, so "the framework assumes the Anthropic stack here" cannot be separated from "the vault has not ingested the alternative." Settling it needs an external source on agent behavioral baselining and on multi-vendor agent-governance policy enforcement — a #oq/source shape.
  • Source"Foundation floor raised" implies a moving baseline. How fast does the tier ladder actually shift, and who arbitrates it (NIST/NSA cadence vs. model-capability cadence)? A datum on where the ladder currently stands (2026-09-02), from delegation without trust agent authz gap analysis (Dantuluri & Sundi, VotalAI, empirical for its broker but analytical for this result — the authors label the table "our reading of each standard's specification rather than measured data" and invite scrutiny of individual cells). Mapping nine identity and delegation primitives (OIDC, OAuth 2.1, Token Exchange RFC 8693, SPIFFE/SPIRE, mTLS RFC 8705, DPoP RFC 9449, Macaroons, Biscuit, MCP authz) against eight requirements, they find no single standard covers the set, and more pointedly that no standard profile exists that mints, at each delegation hop, a token simultaneously attenuated, bound to the sub-agent's workload identity, short-lived, and enforced at a PEP outside the model. Read against this framework's ladder: the multi-agent Advanced rung has no standard to climb — the primitives are mature and un-composed, so the arbiter question is not just "how fast" but "which body composes them", which AIMS already records as plural (IETF, OpenID, and MCP shipping its own rules).
  • SourceThe framework is explicit that it is not legal/compliance assurance. Where does self-attested Zero Trust maturity meet auditable regulatory requirement?