Evidence

SWE-DeceptionBench: Benchmarking Deceptive Behaviors of LLMs Across the Software Development Lifecycle

Sysdig - JADEPUFFER agentic ransomware

Sysdig - JADEPUFFER evolves to target AI/ML assets

TechCrunch - Anthropic multi-agent turf-war experiment

TechCrunch - Microsoft open-source projects compromised to steal AI developer credentials

Terence Tao: Math 2.0 (Caltech lecture slides)

Original 27-page slide deck from the October 2026 Caltech lecture. Page 9 discusses mathematical problem-solving as a proxy for long-term aims; page 20 uses a clearly hypothetical AI-designed treatment to illustrate potential divergence between formal checks, an evaluation outcome, and human understanding.

Terence Tao

The Agent Clicks Approve: Injected Page Text Makes Browser Agents Authorize Access the Task Never Named

Oct 10 original study of browser-agent consent and webhook actions, 73 ungated and 70 gated attack tests.

The Deception Delta companion research artifacts (Zenodo 22686323)

Artifact archive linked from Appendix A of the corrected paper. The authors say it contains synthetic contracts, frozen runtime bytecode, Foundry checks, run responses and judge decisions, labels, and analysis scripts. The archive could not be opened in the research browser, so artifact completeness, checksums and reproducibility were not independently verified.

Timo Schefold / Zenodo

The Hacker News - Claude Opus 4.6 gym-booking boundary violation reproduction

ToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundary

Trellix - OpenClaw supply-chain crisis / ClawHavoc

Trevor Blackwell / exfil source repository

Primary project repository for the GET-based transfer demonstration. The existing corpus preserves its mechanism and separate reproduction locators. Repository-page/raw retrieval was not available in this pass; no production model-weight theft is established by the retained evidence.

Trojan Horse automated repository poisoning against coding agents

The Trojan Horse paper tests automated poisoning of execution-reachable repository locations using TrojanBench, a researcher-constructed corpus of 384 repositories. It measures attack effects in coding-agent harnesses, not the compromise of 384 independent real users.

TrojanStego: Your Language Model Can Secretly Be A Steganographic Privacy Leaking Agent

tronify.rent threat-intelligence record

Living threat-intelligence record for tronify.rent. It records first detection on February 26, 2026, later abuse-report activity and continuing risk signals, establishing that public warning evidence about the domain existed before the alleged September losses.

PhishDestroy

Understanding and Mitigating Cross-Session Attacks via Persistent Artifacts in Agent Skill Composition

US law-enforcement intelligence documents describe two arrests involving fabricated AI evidence given to police — original research or disclosure

Reported evidence for A reported review of law-enforcement records identifies two investigations involving manufactured images or videos submitted as evidence. Research intake: DB-RADAR-CP7-CP7A-077.

Vercel: findings from the one-million-dollar Sandbox challenge

First-party disclosure separating a production-observed host memory leak, laboratory host execution, disk block reuse and cross-account snapshots.

VulnCheck: IntentKit tool execution authorization bypass

CVE-2026-76066 analysis distinguishes hiding tools from users and enforcing permission at ToolNode execution.

VULONE: An exposed Cairn operator infrastructure

What is Anthropic's policy for handling governmental requests for user information?

Anthropic says it does not disclose customer or end-user information in response to government requests except through valid legal process, such as a subpoena or warrant, unless it believes an emergency may result in imminent physical harm or death and immediate disclosure could avert it. Anthropic also says it evaluates requests for legal validity, may reject requests that are broad or vague, and generally gives users notice unless prohibited or a rare exception applies. For API or enterprise customer data, Anthropic says it will generally ask the requester to contact the customer first.

What You Sign Is Not What You Run: GGUF quantized model provenance audit

Liu and Tsai quantify missing environment provenance among the 198 most-downloaded in-scope GGUF repositories and demonstrate partial bit-exact reconstruction.

Where AI Vulnerability Discovery Harnesses Go Quiet

Commit-specific harness analysis with selection-stage demonstrations.

WIRED - Zoom screen-sharing takeover bug

Wiz incident reconstruction: Anatomy of a real AI-driven cloud attack

Wiz CIRT reconstructs a real cloud intrusion through an exposed Kafka UI, compromised cloud and IdP identities, and CI/CD or GitOps effects. The same IP scanned over 600 other environments, not 600 known breaches. The precise automation share and final exported data volume remain uncertain.

Wiz: LiteLLM 1.107.0 credential theft

X-AgentRed: Red-Teaming Personal Agents in Evolving Multi-Service Ecosystems

xAI: Grok Bot approvals, security and privacy

October 20 documentation of approval rules, shared per-user computer state and limits of model-based action review.

XBOW Labs: Zero to Calc in Six Days, full Chrome exploit chain

Technical Oct 13 research account of V8 Maglev, animated WebP and Crashpad issues, with a tested Windows sandbox-escape chain.

XRPL 3.4.1 coordinated disclosure: overflow and Batch wrapper validation

Original XRPL maintainer report on distinct XRP overflow and Batch inner-wrapper issues; credits Veria AI for the overflow report only. Checkpoints DB-RADAR-CP7-CP7A-052 and -053.