Proof-Carrying Messages proposes passing verifiable evidence with agent-to-agent claims. The experiment checks statements against signed receipts and transparency structures, including fabricated or obsolete assertions. Ten stale proofs passed verification because the proof could be cryptographically authentic about an earlier state while no longer matching…
Inspect the ClaimsCase · DiggingBeagle record
Proof-Carrying Messages accepted ten stale proofs in a controlled evaluation
A formal agent-message protocol verifies signed evidence but its experiment accepted ten proofs that were no longer fresh.
Scope
The reported failure is from a laboratory protocol evaluation, not measured field compromise.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade C
- Remediation
- not applicable
- AI role
- AGAINST AI
Basis and provenance
The pinned Claim and its primary disclosure support the described controlled result, but do not establish a population-wide rate or calibrated impact. The source is primary to the described analysis, not independent replication of every outcome. Impact remains unbanded because no calibrated impact rubric for this particular evidence is established.
Assessed Nov 2, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-NOV02-PCM-STALE-PROOF-A · PCM: A Proof-Carrying Message Protocol for Verifiable Multi-Agent Communication
At a glance
Agent evidence needs validity and time-bounded applicability. Signed provenance cannot by itself authorize a future tool effect.
Read the implicationsThe reported failure is from a laboratory protocol evaluation, not measured field compromise. There is no independently deployed current-state attestation protocol in the paper that rules out modifications after its signed evidence snapshot.
Limits and uncertaintyFull account
Proof-Carrying Messages proposes passing verifiable evidence with agent-to-agent claims. The experiment checks statements against signed receipts and transparency structures, including fabricated or obsolete assertions. Ten stale proofs passed verification because the proof could be cryptographically authentic about an earlier state while no longer matching the decision-time state. This is a freshness limitation in a proposed system, not a report of an exploited production authorization service.
The verification result is not an unconditional success story: of 712 fabricated claims in 926 messages, ten were accepted, all using real evidence that had become stale. An authenticated signature or Merkle inclusion can show that a test passed or an approval existed at an earlier point, but not that the code, artifact or authorization remains unchanged when a receiving agent acts. The paper discusses a later freshness-envelope design; its test of the published protocol does not establish that the proposed change closes every race. Proof checks must therefore be tied to a current version and the eventual effect.
Mechanism and trust boundary
- 01
Obtain a valid historical proof
A signed receipt or Merkle inclusion proof establishes a prior fact.
Boundary: Historical witness into a later decision
- 02
Reuse it after relevant state changes
The original approval or data may have been revoked or overwritten.
Boundary: Proof validity versus current authorization
- 03
Verifier accepts the old evidence
A missing freshness check permits a technically valid but stale decision input.
Boundary: Authenticated record into action authority
Claims & evidence
CLM-2026-NOV02-PCM-STALE-PROOF-AThe PCM authors report ten stale-proof acceptances in a controlled corpus of 926 messages; signatures and historical inclusion did not guarantee that the underlying authorization or state was current.supported
Basis: reported finding
- supportsPCM: A Proof-Carrying Message Protocol for Verifiable Multi-Agent Communicationprimary disclosure
PCM paper, Headline results, proof freshness experiments and limitations
CLM-2026-NOV02-PCM-STALE-PROOF-BIn the PCM paper's 926-message benchmark, ten of 712 fabricated claims were accepted, all involving stale evidence; the protocol authors identify freshness as an unresolved limitation.supported
Basis: reported finding
- supportsPCM: A Proof-Carrying Message Protocol for Verifiable Multi-Agent Communicationprimary disclosure
Table 9 and Table 11, PCM-Lies results and stale-evidence status
Implications
Agent evidence needs validity and time-bounded applicability. Signed provenance cannot by itself authorize a future tool effect.
Controls and mitigations
- Bind proofs to current state versions, bounded validity windows, revocations and the exact requested action; reject unverifiable freshness.
- Verify current run head, artifact digest and revocation state at receipt and again at the action boundary, rather than accepting historical inclusion alone.
Unknowns and contradictions
- The reported failure is from a laboratory protocol evaluation, not measured field compromise.
- There is no independently deployed current-state attestation protocol in the paper that rules out modifications after its signed evidence snapshot.
Sources and citation
Material revision history
- Nov 2, 2026 · Canonical change recorded · new in release · revision 214