The Claim Ledger

Every claim every issue makes, filed under the status it earned, and every hypothesis with what would disprove it.

Main window: nodeIntegration on, contextIsolation off, @electron/remote on (source; No. 19 You Should Probably Know: a no-execution audit of Joplin 3.7.22)

Plugin runner uses the same unhardened flags (source; No. 19 You Should Probably Know: a no-execution audit of Joplin 3.7.22)

Note content is site-isolated (cross-protocol iframe, separate process) (source; No. 19 You Should Probably Know: a no-execution audit of Joplin 3.7.22)

No IPC / custom-protocol escape of that isolation was ruled out (open; No. 19 You Should Probably Know: a no-execution audit of Joplin 3.7.22)

Plugins fetched with no integrity field in the manifest (source; No. 19 You Should Probably Know: a no-execution audit of Joplin 3.7.22)

A malicious/updated/compromised plugin → full- privilege code execution (untested chain; No. 19 You Should Probably Know: a no-execution audit of Joplin 3.7.22)

Recommended-plugin vetting and Restricted install mode exist (source; No. 19 You Should Probably Know: a no-execution audit of Joplin 3.7.22)

AES-256-GCM, PBKDF2-SHA512 220k, RSA- OAEP-2048 (source; No. 19 You Should Probably Know: a no-execution audit of Joplin 3.7.22)

Per-item iterationCount 3 is correct, not a weakness (inference; No. 19 You Should Probably Know: a no-execution audit of Joplin 3.7.22)

Legacy SJCL methods kept to decrypt old data; the original uses PBKDF2 at 1,000 (source; No. 19 You Should Probably Know: a no-execution audit of Joplin 3.7.22)

Linux 7-Zip copy runs from the profile cache, MD5- compared when checked (source; No. 19 You Should Probably Know: a no-execution audit of Joplin 3.7.22)

E2EE whole-system correctness under every path (open; No. 19 You Should Probably Know: a no-execution audit of Joplin 3.7.22)

Sync envelope leaks graph/types/timestamps/sizes (source; No. 19 You Should Probably Know: a no-execution audit of Joplin 3.7.22)

Local database/attachments plaintext at rest (source; No. 19 You Should Probably Know: a no-execution audit of Joplin 3.7.22)

MCP/AI note-read egress path exists, setting-gated (source; No. 19 You Should Probably Know: a no-execution audit of Joplin 3.7.22)

MCP path's auth depth and defaults (open; No. 19 You Should Probably Know: a no-execution audit of Joplin 3.7.22)

macOS binaries signed, no W+X, max entropy 6.956 (source; No. 19 You Should Probably Know: a no-execution audit of Joplin 3.7.22)

Windows/Linux binaries benign (open; No. 19 You Should Probably Know: a no-execution audit of Joplin 3.7.22)

Release assets matched SHA256SUMS.txt and GitHub digests (Established; No. 17 Mostly Harmless: a no-execution audit of PhotoCraft 0.17.0 for backdoors, phone-home and leaks)

Every registry crate recovered from the Linux binaries' source paths is in Cargo.lock (Established (consistency, not completeness); No. 17 Mostly Harmless: a no-execution audit of PhotoCraft 0.17.0 for backdoors, phone-home and leaks)

Listeners are loopback/ Unix-socket and token- protected; MCP is stdio; the bridge refuses non- loopback addresses (Established; No. 17 Mostly Harmless: a no-execution audit of PhotoCraft 0.17.0 for backdoors, phone-home and leaks)

A malicious same-user process can use the local tokens: open files via the single-instance channel, and drive the editor when the control server is on (Established (source); No. 17 Mostly Harmless: a no-execution audit of PhotoCraft 0.17.0 for backdoors, phone-home and leaks)

Update requests go to api.github.com and github.com, plus GitHub's githubusercontent.com redirect hosts and any configured proxy (Established (static; not observed on the wire); No. 17 Mostly Harmless: a no-execution audit of PhotoCraft 0.17.0 for backdoors, phone-home and leaks)

Update check on by default, once per launch, can be disabled; manual checks remain (Established; No. 17 Mostly Harmless: a no-execution audit of PhotoCraft 0.17.0 for backdoors, phone-home and leaks)

No telemetry, analytics or crash upload in source (Established (static); No. 17 Mostly Harmless: a no-execution audit of PhotoCraft 0.17.0 for backdoors, phone-home and leaks)

A pattern scan of the fork diffs found no direct network, process, env or file-write calls (Established (scan scope only); No. 17 Mostly Harmless: a no-execution audit of PhotoCraft 0.17.0 for backdoors, phone-home and leaks)

Linux GUI ships rustls- webpki 0.103.15 (Established; No. 17 Mostly Harmless: a no-execution audit of PhotoCraft 0.17.0 for backdoors, phone-home and leaks)

The Linux updater's certificate verification runs through rustls-platform- verifier into rustls-webpki (Established (source); No. 17 Mostly Harmless: a no-execution audit of PhotoCraft 0.17.0 for backdoors, phone-home and leaks)

RUSTSEC-2026-0382 affects 0.103.15, fixed in 0.103.16 (Established; No. 17 Mostly Harmless: a no-execution audit of PhotoCraft 0.17.0 for backdoors, phone-home and leaks)

CVE-2026-111943 was issued by Go for crypto/ x509; RustSec lists it as an alias of RUSTSEC-2026-0382 (Established; No. 17 Mostly Harmless: a no-execution audit of PhotoCraft 0.17.0 for backdoors, phone-home and leaks)

All eight compromised intermediates (six TLS, two code-signing) have Sectigo cross-signs chaining to AAA Certificate Services (Established; No. 17 Mostly Harmless: a no-execution audit of PhotoCraft 0.17.0 for backdoors, phone-home and leaks)

Linux updates verified by same-channel SHA-256 only; macOS team signature; Windows Authenticode; no FreeBSD self-update (Established (source); No. 17 Mostly Harmless: a no-execution audit of PhotoCraft 0.17.0 for backdoors, phone-home and leaks)

Ubuntu 24.04 removed AAA in June and emSign ECC G3 on 2026-10-20 (Established; No. 17 Mostly Harmless: a no-execution audit of PhotoCraft 0.17.0 for backdoors, phone-home and leaks)

Audit host trusted both anchors: never upgraded ca-certificates, and main dropped from its apt sources on 19 October (Established for one host (as of 30 October; fixed 31 October); No. 17 Mostly Harmless: a no-execution audit of PhotoCraft 0.17.0 for backdoors, phone-home and leaks)

Prevalence of lagging trust stores (Unknown; No. 17 Mostly Harmless: a no-execution audit of PhotoCraft 0.17.0 for backdoors, phone-home and leaks)

Forged update installs on a lagging host after the user accepts it (and, for package installs, enters a password) (Hypothesis (not executed); No. 17 Mostly Harmless: a no-execution audit of PhotoCraft 0.17.0 for backdoors, phone-home and leaks)

Release workflow follows @main with signing secrets; no provenance (Established; No. 17 Mostly Harmless: a no-execution audit of PhotoCraft 0.17.0 for backdoors, phone-home and leaks)

An unauthorized change can reach that workflow (Unverified (repository settings not visible); No. 17 Mostly Harmless: a no-execution audit of PhotoCraft 0.17.0 for backdoors, phone-home and leaks)

Release packages omit required license texts (Established; No. 17 Mostly Harmless: a no-execution audit of PhotoCraft 0.17.0 for backdoors, phone-home and leaks)

Ticket bot publishes Discord IDs (Established; No. 17 Mostly Harmless: a no-execution audit of PhotoCraft 0.17.0 for backdoors, phone-home and leaks)

photocraft.one is not linked from the project, uses template privacy copy, embeds miniPaint (Established; No. 17 Mostly Harmless: a no-execution audit of PhotoCraft 0.17.0 for backdoors, phone-home and leaks)

photocraft.one's operator (Unverified (no affiliation established); No. 17 Mostly Harmless: a no-execution audit of PhotoCraft 0.17.0 for backdoors, phone-home and leaks)

0.18.0 still pins rustls- webpki 0.103.15 in its lockfile (Established (lockfile; binaries not examined); No. 17 Mostly Harmless: a no-execution audit of PhotoCraft 0.17.0 for backdoors, phone-home and leaks)

Clean-room more likely than not (Best Educated Guess (author judgment; provenance not assessed); No. 17 Mostly Harmless: a no-execution audit of PhotoCraft 0.17.0 for backdoors, phone-home and leaks)

Hawthorne 3.8, Species III, rubric v0.3 (Author assessment; vectors and inputs published in section 9; No. 17 Mostly Harmless: a no-execution audit of PhotoCraft 0.17.0 for backdoors, phone-home and leaks)

407 of 10,000 sites (4.1%) had interchangeable requests: 12.7% of sites with a captured POST, 14.9% with a replayable one (Established (one crawl); No. 16 HTTP method equivalence is not state equivalence)

646 of 8,291 routes (7.8%) and 1,228 of 14,244 requests (8.6%) were interchangeable (Established (one crawl); No. 16 HTTP method equivalence is not state equivalence)

1,782 more requests matched but so did the no-parameter control, and were set aside as ambiguous (Established; No. 16 HTTP method equivalence is not state equivalence)

The crawl was unauthenticated and skipped destructive, session- changing and upload controls (Established; No. 16 HTTP method equivalence is not state equivalence)

The 1,228: 30.9% search, 15.1% analytics, 9.9% API, 8.9% auth, 7.7% unknown (Established; No. 16 HTTP method equivalence is not state equivalence)

SameSite=Lax cookies ride on cross-site top-level GET navigations but not cross- site POSTs (Established; No. 16 HTTP method equivalence is not state equivalence)

7 of 115 token-bearing requests, on 2 sites, refused a forged token on POST and accepted it on GET; 78 showed no enforcement either way; state change and cross-site triggering not verified (Established (method- scoped gap); No. 16 HTTP method equivalence is not state equivalence)

56 requests (9 sites) gave payload-induced cross- session cache hits; 136 (50 sites) were cacheable without one; no disclosure shown (Established; No. 16 HTTP method equivalence is not state equivalence)

Safe methods must not execute client-requested unsafe actions; incidental effects such as logging may occur (Established; No. 16 HTTP method equivalence is not state equivalence)

Django skips CSRF token checks on safe methods by design (Established; No. 16 HTTP method equivalence is not state equivalence)

Flask routes default to GET (with HEAD, OPTIONS); Django keeps request.GET and request.POST apart (Established; No. 16 HTTP method equivalence is not state equivalence)

Spring's @RequestMapping matches all methods by default; PHP's $_REQUEST merges $_GET, $_POST and $_COOKIE (Established; No. 16 HTTP method equivalence is not state equivalence)

Vanilla PHP and some Spring MVC and ASP.NET Core setups are the most prone (Established (mechanism only); No. 16 HTTP method equivalence is not state equivalence)

The frameworks behind the 407 sites have not been measured against the wider list (Unknown; No. 16 HTTP method equivalence is not state equivalence)

CRS 4.0 rule 942100 targets ARGS, query and body alike (Established; No. 16 HTTP method equivalence is not state equivalence)

The #3585 and #3587 bypasses are payload obfuscation on end-of-life CRS 3.3.2, not method conversion (Established; No. 16 HTTP method equivalence is not state equivalence)

Cache deception needs no state change (Established; No. 16 HTTP method equivalence is not state equivalence)

H1: few converted GETs act unsafely (Hypothesis; No. 16 HTTP method equivalence is not state equivalence)

H2: WAF parity within 5 points (Hypothesis; No. 16 HTTP method equivalence is not state equivalence)

H3: PHP and Spring over- represented (Hypothesis; No. 16 HTTP method equivalence is not state equivalence)

H4: some cache hits leak private content (Hypothesis; No. 16 HTTP method equivalence is not state equivalence)

PNI (D_A = 0) is necessary and sufficient for an unbiased plain certificate against every adaptive agent (Established (paper's model); No. 15 Can agents tell when they are being audited?)

Worst-case bias is (1- ε)D_A; no labels-only procedure does better (Established (paper's model); No. 15 Can agents tell when they are being audited?)

Raising ε shrinks the bias bound linearly but brings coverage failure earlier, for ε up to ε * ≥ 1/3 (Established (paper's model); No. 15 Can agents tell when they are being audited?)

A fresh per-call coin keeps PNI for that call, whatever earlier coins leak (Established (paper's model); No. 15 Can agents tell when they are being audited?)

A shared load reading that includes a session's own coin leaks D_A equal to the mode probability of Bin(M-1, ε): 0.80 for two sessions at ε = 0.2 (Established (paper's model); No. 15 Can agents tell when they are being audited?)

D_A values for 3 to 100 sessions at ε = 0.2 (Established (arithmetic); No. 15 Can agents tell when they are being audited?)

A visible audit notice moved gpt-4.1-mini's attack success from 0.676 to 0.544 ( Δ = 0.132, Holm p = 0.012) (Established (one model, one suite); No. 15 Can agents tell when they are being audited?)

A silent audit left decisions and recorded 400-character response prefixes identical in 1,000 paired runs (D_A ≤ 0.006) but added 6.8 ms of median latency; timestamps gave D_A ≥ 0.99 (Established (one gate); No. 15 Can agents tell when they are being audited?)

The agent controls the timing leak: the median gap grew from 10 ms to 58 ms as it read 32 more objects (Established (one gate); No. 15 Can agents tell when they are being audited?)

A fixed padding ceiling was overrun at 48 extra objects (D_A ≥ 0.91) (Established (one gate); No. 15 Can agents tell when they are being audited?)

A classifier gives only a lower bound, D_A ≥ 2a-1; no distribution-free upper bound exists for high- dimensional transcripts (Established; No. 15 Can agents tell when they are being audited?)

From a ROC AUC, TV ≥ 1- √ (2(1-AUC)), since a ROC curve never rises more than TV above the diagonal; 2·AUC-1 is not a lower bound (Established (derivation); No. 15 Can agents tell when they are being audited?)

A per-call certificate can be diluted: 30 dangerous episodes in 100 can show as under 1 percent of calls (Established (arithmetic); No. 15 Can agents tell when they are being audited?)

Independent network jitter carries no coin information (Established; No. 15 Can agents tell when they are being audited?)

Post-deployment auditing is advocated but not yet the common form of agent risk control (Established; No. 15 Can agents tell when they are being audited?)

LangChain's observability documentation publishes no audit rate, estimator or pre- commit coin secrecy (Established (as of 30 October 2026); No. 15 Can agents tell when they are being audited?)

Recognizing an evaluation rarely goes with a change in behavior (Established (their finding); No. 15 Can agents tell when they are being audited?)

A count-only padding ceiling failed with 64 KB objects; a count-and-kilobytes ceiling failed on 85–99 of 100 audited runs at CPU saturation; fail-closed counting kept the certificate sound (Established (one host); No. 15 Can agents tell when they are being audited?)

H1–H4, as stated under Falsifiable claims (Hypothesis; No. 15 Can agents tell when they are being audited?)

System uses SQLite FTS5/BM25, not vectors (Established; No. 14 Assessing Offline LLM Efficacy for Emergency Operations)

Install size 19 GB vs README 21 GB dispute (Disputed; No. 14 Assessing Offline LLM Efficacy for Emergency Operations)

100 W applies only to answering intervals (5–40s), as the vendor states (Established; No. 14 Assessing Offline LLM Efficacy for Emergency Operations)

Qwen 27B: 80% accuracy score; main point right 21 of 22 (Established; No. 14 Assessing Offline LLM Efficacy for Emergency Operations)

Granite 8B: 55% accuracy score; main point right 14 of 22 (Established; No. 14 Assessing Offline LLM Efficacy for Emergency Operations)

3B model advised against a tourniquet on an arm and 3 ft from a downed line; vendor disclosed both and dropped it (Established; No. 14 Assessing Offline LLM Efficacy for Emergency Operations)

The answer-anyway rule caused or raises harmful answers (Unknown; No. 14 Assessing Offline LLM Efficacy for Emergency Operations)

Citations may be rewritten by core.py (Established; No. 14 Assessing Offline LLM Efficacy for Emergency Operations)

Vendor assigns 27B to Macs with 32–96 GB (Established; No. 14 Assessing Offline LLM Efficacy for Emergency Operations)

59 zero-error trials needed for <5% bound (Established; No. 14 Assessing Offline LLM Efficacy for Emergency Operations)

App checks once a day for updates while running; vendor says nothing about you is sent (Established; No. 14 Assessing Offline LLM Efficacy for Emergency Operations)

core.py declares search_library, read_article, show_article and the answer-anyway rule (Established; No. 14 Assessing Offline LLM Efficacy for Emergency Operations)

Llama-3-27B does not exist (use Qwen 27B) (Established; No. 14 Assessing Offline LLM Efficacy for Emergency Operations)

Energy metric should be J/CA, not sustained watts (Best Educated Guess; No. 14 Assessing Offline LLM Efficacy for Emergency Operations)

Human trust reliance cannot be measured in audit (Unknown; No. 14 Assessing Offline LLM Efficacy for Emergency Operations)

Legal liability applicability is untested (Unknown; No. 14 Assessing Offline LLM Efficacy for Emergency Operations)

Fu et al. report little MIA reduction across their tested 4-8 bit configurations (Established; No. 13 Quantization is not a privacy guarantee)

4-8 bit quantization preserves MIA risk beyond the studied configurations (Best Educated Guess; No. 13 Quantization is not a privacy guarantee)

8-bit quantization preserves confidence gaps in the tested configurations (Established; No. 13 Quantization is not a privacy guarantee)

Black-box attacks work without gradients (Established; No. 13 Quantization is not a privacy guarantee)

Accuracy-matched controls separate compression artifacts (Best Educated Guess; No. 13 Quantization is not a privacy guarantee)

Prior work conflates utility loss with privacy gain (Best Educated Guess; No. 13 Quantization is not a privacy guarantee)

4-bit MobileNetV2/CINIC-10 reduces attack accuracy (Established; No. 13 Quantization is not a privacy guarantee)

2-bit quantization reduces leakage with high variance (Best Educated Guess; No. 13 Quantization is not a privacy guarantee)

LLM leakage profiles mirror vision classifiers (Best Educated Guess; No. 13 Quantization is not a privacy guarantee)

Distribution shift confounds LLM MIA (Established; No. 13 Quantization is not a privacy guarantee)

At 1.58 bits, utility costs grow and results vary widely between runs (Best Educated Guess; No. 13 Quantization is not a privacy guarantee)

DP guarantees survive quantization that uses no private data; private calibration needs budget accounting (Established; No. 13 Quantization is not a privacy guarantee)

Enclaves protect execution, not outputs (Established; No. 13 Quantization is not a privacy guarantee)

Compression alone does not demonstrate erasure (Best Educated Guess; No. 13 Quantization is not a privacy guarantee)

Article 17 specifies grounds, not thresholds (Established; No. 13 Quantization is not a privacy guarantee)

Aggregate AUC hides identification at low FPR (Established; No. 13 Quantization is not a privacy guarantee)

Nonsignificance is not equivalence (Established; No. 13 Quantization is not a privacy guarantee)

Famili & Lao Table 5 TP columns disputed (Disputed; No. 13 Quantization is not a privacy guarantee)

Priv-QDNN preprocessing asymmetry unverified (Unverified; No. 13 Quantization is not a privacy guarantee)

Quantization-adapted shadow models required for Famili & Lao (Best Educated Guess; No. 13 Quantization is not a privacy guarantee)

LLM membership provenance requires specific evidence (Best Educated Guess; No. 13 Quantization is not a privacy guarantee)

1.58-bit BRECQ exhibits high run- to-run variance (Established; No. 13 Quantization is not a privacy guarantee)

BRECQ 2-bit accuracy drops are 0.5%, 0.4%, 0.9% (Established; No. 13 Quantization is not a privacy guarantee)

Priv-QDNN pins torch 2.5.1 (Established; No. 13 Quantization is not a privacy guarantee)

Training transforms applied to members vs nonmembers (Best Educated Guess; No. 13 Quantization is not a privacy guarantee)

On-device execution does not prevent black-box inference (Established; No. 13 Quantization is not a privacy guarantee)

Fix merged Oct 15, 2026 (Established; No. 12 EDK II PXE bug: which shipped firmware and VM images actually contain the fix?)

What each fix commit does (Established; No. 12 EDK II PXE bug: which shipped firmware and VM images actually contain the fix?)

No stable release has it yet (Established; No. 12 EDK II PXE bug: which shipped firmware and VM images actually contain the fix?)

Mu backport out Oct 26 (Established; No. 12 EDK II PXE bug: which shipped firmware and VM images actually contain the fix?)

Debian tracker: Vulnerable (Established; No. 12 EDK II PXE bug: which shipped firmware and VM images actually contain the fix?)

SUSE: Pending; ovmf Affected (Established; No. 12 EDK II PXE bug: which shipped firmware and VM images actually contain the fix?)

Ubuntu: Needs evaluation (Established; No. 12 EDK II PXE bug: which shipped firmware and VM images actually contain the fix?)

VM runs host's firmware (Established; No. 12 EDK II PXE bug: which shipped firmware and VM images actually contain the fix?)

Shielded VM PCR0: 3 events (Established; No. 12 EDK II PXE bug: which shipped firmware and VM images actually contain the fix?)

Hetzner: Rescue boot risk (Established; No. 12 EDK II PXE bug: which shipped firmware and VM images actually contain the fix?)

AL2023 edk2: Not Affected (Established; No. 12 EDK II PXE bug: which shipped firmware and VM images actually contain the fix?)

AL2023: reason not stated (Open (unresolved); No. 12 EDK II PXE bug: which shipped firmware and VM images actually contain the fix?)

OVMF X64: PXE on by default (Established; No. 12 EDK II PXE bug: which shipped firmware and VM images actually contain the fix?)

Module GUID: B95E9FDA… (Established; No. 12 EDK II PXE bug: which shipped firmware and VM images actually contain the fix?)

Flawed loop in 2010 import (Established; No. 12 EDK II PXE bug: which shipped firmware and VM images actually contain the fix?)

OEM firmware lag (Open (unresolved); No. 12 EDK II PXE bug: which shipped firmware and VM images actually contain the fix?)

102 hidden blocks on 80 of 545 linked WhatsApp help pages. (Established (as reported); No. 11 Written for the Chatbot, Sent to Everyone: auditing the text help pages carry for machines)

No comparable notes on 300 Facebook and Instagram help pages. (Established (as reported); No. 11 Written for the Chatbot, Sent to Everyone: auditing the text help pages carry for machines)

Notes present 15 Oct 21:40 UTC, all gone by 18 Oct 02:08 UTC. (Established; No. 11 Written for the Chatbot, Sent to Everyone: auditing the text help pages carry for machines)

WhatsApp: the notes were chatbot instructions, exposed by a bug now fixed. (Established (as stated by WhatsApp); No. 11 Written for the Chatbot, Sent to Everyone: auditing the text help pages carry for machines)

The notes are HelpContentGalaxyLLMInclude nodes in the page's JSON content tree. (Established; No. 11 Written for the Chatbot, Sent to Everyone: auditing the text help pages carry for machines)

HelpContentGalaxyLLMExclude is also among the page's components, before and after removal. (Established; No. 11 Written for the Chatbot, Sent to Everyone: auditing the text help pages carry for machines)

Search crawler names got the notes; AI crawler names got neither notes nor article. (Established (spoofed- name test); No. 11 Written for the Chatbot, Sent to Everyone: auditing the text help pages carry for machines)

Five of six tools returned neither notes nor article from the raw page; Turndown returned both. (Established; No. 11 Written for the Chatbot, Sent to Everyone: auditing the text help pages carry for machines)

Captures of different URL variants disagree on whether the notes are present. (Established; No. 11 Written for the Chatbot, Sent to Everyone: auditing the text help pages carry for machines)

A claimed user agent can't verify a crawler; Google verifies by DNS, OpenAI and Anthropic publish IPs. (Established; No. 11 Written for the Chatbot, Sent to Everyone: auditing the text help pages carry for machines)

33 of 113 help URLs differed by user agent after slow re-fetching. (Established (as reported); No. 11 Written for the Chatbot, Sent to Everyone: auditing the text help pages carry for machines)

Khodayari: 15.3K validated injections in 1.2B URLs; about 70% in non-rendered HTML. (Established; No. 11 Written for the Chatbot, Sent to Everyone: auditing the text help pages carry for machines)

OWASP #855 rerun: zero Tier A/B matches on 2,924 distinct reachable sites. (Established; No. 11 Written for the Chatbot, Sent to Everyone: auditing the text help pages carry for machines)

Zero of 200 bounds the rate below 1.49%; showing more than 10% needs 28. (Established; No. 11 Written for the Chatbot, Sent to Everyone: auditing the text help pages carry for machines)

The capability was built on purpose; whether publishing the notes was intended. (Open (unresolved); No. 11 Written for the Chatbot, Sent to Everyone: auditing the text help pages carry for machines)

Whether WhatsApp's chatbot or any outside assistant acted on the notes. (Open (unresolved); No. 11 Written for the Chatbot, Sent to Everyone: auditing the text help pages carry for machines)

At least 2% of reachable help centres carry such text (H1). (Hypothesis; No. 11 Written for the Chatbot, Sent to Everyone: auditing the text help pages carry for machines)

Most positives are sent to browsers, not only to claimed crawlers (H2). (Hypothesis; No. 11 Written for the Chatbot, Sent to Everyone: auditing the text help pages carry for machines)

Article extractors drop such text in most positives (H3). (Hypothesis; No. 11 Written for the Chatbot, Sent to Everyone: auditing the text help pages carry for machines)

Affected: Brotli 1.0.3–1.2.0; fixed in 1.0.10, 1.1.1, 1.2.1. (Established; No. 10 Broccoli2Shell: counting vendored Brotli decoders hiding in the software supply chain)

The helper reported an invalid switch as "need more input", overrunning an eight-byte buffer. (Established; No. 10 Broccoli2Shell: counting vendored Brotli decoders hiding in the software supply chain)

The fix adds error code -17, _ERROR_FORMAT_BLOCK_SWITCH; -17 was reserved in 1.2.0. (Established; No. 10 Broccoli2Shell: counting vendored Brotli decoders hiding in the software supply chain)

Commit dated 27 Feb 2026; fixed releases 21 Oct 2026. (Established; No. 10 Broccoli2Shell: counting vendored Brotli decoders hiding in the software supply chain)

ELLIO's chain reached a shell on four default Node.js 24.22.0 x86-64 targets. (Established; No. 10 Broccoli2Shell: counting vendored Brotli decoders hiding in the software supply chain)

The captured attacker chain (26 Oct, 15:08 UTC) got 0 shells in 50 tests. (Established; No. 10 Broccoli2Shell: counting vendored Brotli decoders hiding in the software supply chain)

Added to KEV 27 Oct 2026, due 10 Nov 2026, under BOD 26-04. (Established; No. 10 Broccoli2Shell: counting vendored Brotli decoders hiding in the software supply chain)

Node.js 24.22.1 bundles version 1.2.0 and 22.23.4 bundles 1.1.0, both with the fix. (Established; No. 10 Broccoli2Shell: counting vendored Brotli decoders hiding in the software supply chain)

Syft has no Brotli binary classifier at e6813ba. (Established; No. 10 Broccoli2Shell: counting vendored Brotli decoders hiding in the software supply chain)

Wiz: 91% of cloud environments have vulnerable resources (vendor telemetry). (Established (as reported); No. 10 Broccoli2Shell: counting vendored Brotli decoders hiding in the software supply chain)

The fix string matched patch status in 8 of 8 official release artifacts. (Established; No. 10 Broccoli2Shell: counting vendored Brotli decoders hiding in the software supply chain)

Zero false calls in n negatives bounds the false-positive rate near 3/n. (Established; No. 10 Broccoli2Shell: counting vendored Brotli decoders hiding in the software supply chain)

The string signal survives optimized and stripped builds (H1). (Hypothesis; No. 10 Broccoli2Shell: counting vendored Brotli decoders hiding in the software supply chain)

At least 10% of Brotli-bearing native artifacts still lack the fix (H2). (Hypothesis; No. 10 Broccoli2Shell: counting vendored Brotli decoders hiding in the software supply chain)

Syft misses at least half of confirmed tier-C copies (H3). (Hypothesis; No. 10 Broccoli2Shell: counting vendored Brotli decoders hiding in the software supply chain)

How many vulnerable copies ship in PyPI and npm native artifacts. (Open (unresolved); No. 10 Broccoli2Shell: counting vendored Brotli decoders hiding in the software supply chain)

URL-writing rates at the four cuts are 4%, 4%, 92%, 98%. (Established; No. 09 What a Local GPU Can and Can't Check About Qwen3.8's Phone-Home URLs)

Bare metadata-IP rates are 36%, 23%, 1%, 6%; watchlist 0.5%, 0.5%, 23%, 8%. (Established; No. 09 What a Local GPU Can and Can't Check About Qwen3.8's Phone-Home URLs)

The unprompted behavior occurred in under one call in 100,000. (Established (as reported; not independently measurable); No. 09 What a Local GPU Can and Can't Check About Qwen3.8's Phone-Home URLs)

The attempted upload died at the sandbox wall. (Established (as reported); No. 09 What a Local GPU Can and Can't Check About Qwen3.8's Phone-Home URLs)

The released trace has no tool result; its timestamps are export time. (Established; No. 09 What a Local GPU Can and Can't Check About Qwen3.8's Phone-Home URLs)

The task prompt is about curl downloading scripts to /tmp. (Established; No. 09 What a Local GPU Can and Can't Check About Qwen3.8's Phone-Home URLs)

Flash-Next: 125B + 51B n- gram + 4B MTP; 335.28 GiB BF16, 172.78 GiB FP8. (Established; No. 09 What a Local GPU Can and Can't Check About Qwen3.8's Phone-Home URLs)

64 replays of the destination gave 52 distinct hosts. (Established; No. 09 What a Local GPU Can and Can't Check About Qwen3.8's Phone-Home URLs)

A curl/wget order swap cut curl commands from 15/32 to 4/32 (generated, not executed). (Established; No. 09 What a Local GPU Can and Can't Check About Qwen3.8's Phone-Home URLs)

routify proxy calls in three Qwen3.8 models, none in the Qwen3.7 traces checked. (Established; No. 09 What a Local GPU Can and Can't Check About Qwen3.8's Phone-Home URLs)

Qwen3.8-27B: routify first host in 253/31,000; none on Qwen3.6. (Established; No. 09 What a Local GPU Can and Can't Check About Qwen3.8's Phone-Home URLs)

Qwen3.8-27B: no -o jump; metadata ≤ 0.3%; tool call after no-tools reasoning 1,000/1,000. (Established; No. 09 What a Local GPU Can and Can't Check About Qwen3.8's Phone-Home URLs)

An IP literal needs no DNS lookup, so DNS sinkholes miss it. (Established; No. 09 What a Local GPU Can and Can't Check About Qwen3.8's Phone-Home URLs)

The -o jump holds on Flash-Next (H1). (Hypothesis; No. 09 What a Local GPU Can and Can't Check About Qwen3.8's Phone-Home URLs)

The task prompt primes the URL (H2). (Hypothesis; No. 09 What a Local GPU Can and Can't Check About Qwen3.8's Phone-Home URLs)

The watchlist share is specific to Flash-Next (H3). (Hypothesis; No. 09 What a Local GPU Can and Can't Check About Qwen3.8's Phone-Home URLs)

Reasoning doesn't predict the action on Flash-Next (H4). (Hypothesis; No. 09 What a Local GPU Can and Can't Check About Qwen3.8's Phone-Home URLs)

The routify template appears in public corpora. (Open (unresolved); No. 09 What a Local GPU Can and Can't Check About Qwen3.8's Phone-Home URLs)

Who put the behavior there, and why. (Open (unresolved); No. 09 What a Local GPU Can and Can't Check About Qwen3.8's Phone-Home URLs)

Three channels; tool output untrusted; system, user and generated tokens trusted. (Established; No. 08 Architectural Defenses Against Prompt Injection)

Gates add log σ (g) per head and channel pair before the softmax. (Established; No. 08 Architectural Defenses Against Prompt Injection)

18,432 gate parameters (GPT- OSS-20B), 46,080 (Llama-3.3-70B). (Established; No. 08 Architectural Defenses Against Prompt Injection)

An all-trusted run is not identical to the base model, because of the sink. (Established; No. 08 Architectural Defenses Against Prompt Injection)

DPO on frozen base weights; about 4 h (GPT-OSS) and 2 h (Llama) on eight 80 GB GPUs. (Established; No. 08 Architectural Defenses Against Prompt Injection)

Highest RL-Hammer ASR on GPT- OSS-20B: 97% / 85% / 10% (undefended / SecAlign / HoS). (Established; No. 08 Architectural Defenses Against Prompt Injection)

At low reasoning effort, the highest ASR against HoS is 36%. (Established; No. 08 Architectural Defenses Against Prompt Injection)

White-box V38 needs 2.6–2.7× (AgentDojo) and 3.2–3.6× (InjecAgent) the compute to reach 50% on HoS. (Established; No. 08 Architectural Defenses Against Prompt Injection)

On Llama-3.3-70B, 20 white-box examples can't rank HoS against SecAlign. (Established; No. 08 Architectural Defenses Against Prompt Injection)

WASP clean utility 56.22% → 41.62% at lr 0.1; 57.30% at lr 0.01. (Established; No. 08 Architectural Defenses Against Prompt Injection)

Llama-3.3-70B: AgentDojo 53.7% → 58.5%, AgentDyn 33.7% → 18.3%. (Established; No. 08 Architectural Defenses Against Prompt Injection)

Prefix caching is off for gated runs, to stop labels leaking between requests. (Established; No. 08 Architectural Defenses Against Prompt Injection)

enforce_eager is on because CUDA-graph replay wouldn't see per-step channels. (Established; No. 08 Architectural Defenses Against Prompt Injection)

The HF path's extra mask tensor cost a third more peak memory; chunking removed it. (Established; No. 08 Architectural Defenses Against Prompt Injection)

The server exposes a -vanilla model that is bit-exactly the base model. (Established; No. 08 Architectural Defenses Against Prompt Injection)

Prefill is labeled trusted assistant text. (Established; No. 08 Architectural Defenses Against Prompt Injection)

The -vanilla arm runs in the gated engine: eager on, prefix caching off, zero bias. (Established; No. 08 Architectural Defenses Against Prompt Injection)

A channel-aware prefix cache would be correct. (Hypothesis; No. 08 Architectural Defenses Against Prompt Injection)

Relabeled or summarized attacker text defeats the gates (H1, H2). (Hypothesis; No. 08 Architectural Defenses Against Prompt Injection)

A provenance-preserving summary restores protection cheaply (H3). (Hypothesis; No. 08 Architectural Defenses Against Prompt Injection)

HoS serving latency and throughput overhead. (Open (unresolved); No. 08 Architectural Defenses Against Prompt Injection)

AaOS maps 116 OS mechanisms in 19 subsystems to deployed agents; 11 are isomorphic and 65 (56%) missing. (Established; No. 07 The Missing Ring-0 Protections for AI Agents)

In Claude Code, Codex CLI and Gemini CLI, a file write the file tool refuses goes through the shell. (Established; No. 07 The Missing Ring-0 Protections for AI Agents)

All three CLIs load a forged transcript record as a user message on resume; sub-agents inherit their parent's permissions. (Established; No. 07 The Missing Ring-0 Protections for AI Agents)

A model-based permission monitor in these CLIs receives text the agent controls. (Established; No. 07 The Missing Ring-0 Protections for AI Agents)

Rules written in the prompt meet none of Anderson's reference-monitor criteria. (Established; No. 07 The Missing Ring-0 Protections for AI Agents)

AutoGen defaults to Docker code execution from 0.2.8 and errors if Docker isn't running. (Established; No. 07 The Missing Ring-0 Protections for AI Agents)

CrewAI removed CodeInterpreterTool, including its Docker sandbox and SandboxPython fallback, in response to CERT/CC-coordinated vulnerabilities including CVE-2026-2275. (Established; No. 07 The Missing Ring-0 Protections for AI Agents)

Claude Code's sandbox is off by default and covers shell commands, not the built-in file and web tools. (Established; No. 07 The Missing Ring-0 Protections for AI Agents)

FIDES is Python-only and not enforced with the Monty, Hyperlight or.NET Local CodeAct providers. (Established; No. 07 The Missing Ring-0 Protections for AI Agents)

CVE-2026-28277 alone requires write access to stored checkpoint bytes; chained with CVE-2025-67644 it reaches code execution where get_state_history() exposes a user- controlled filter. (Established; No. 07 The Missing Ring-0 Protections for AI Agents)

CaMeL solves 77% of AgentDojo tasks with provable security, against 84% undefended. (Established; No. 07 The Missing Ring-0 Protections for AI Agents)

CXI reports 720 AgentDojo episodes and 400 code-agent episodes with 231 safe task completions. (Established; No. 07 The Missing Ring-0 Protections for AI Agents)

Under pressure, τ -bench's standard agent made unconfirmed changes in 13 of 50 gpt-4.1 tasks and 29 of 128 Haiku task-runs; Concordat made none. (Established; No. 07 The Missing Ring-0 Protections for AI Agents)

Commit Boundary is a conceptual architecture for entity resolution, not implemented or empirically validated. (Established; No. 07 The Missing Ring-0 Protections for AI Agents)

A commit boundary for coding agents requires staged effects and executor- held credentials. (Hypothesis; No. 07 The Missing Ring-0 Protections for AI Agents)

At least 90% of a coding agent's side- effecting calls can be staged without breaking tasks. (Hypothesis; No. 07 The Missing Ring-0 Protections for AI Agents)

Claim-specific evidence promotion blocks an attack class that CXI- and Concordat-style enforcement admit. (Hypothesis; No. 07 The Missing Ring-0 Protections for AI Agents)

Zero failures in 500 independent trials gives a one-sided 95% upper bound of 0.5974%. (Established; No. 07 The Missing Ring-0 Protections for AI Agents)

NIST's February 2026 concept paper proposes a demonstration project, not a mandate. (Established; No. 07 The Missing Ring-0 Protections for AI Agents)

78% of surveyed respondents lack documented AI-identity policies; 92% doubt legacy IAM handles AI/NHI risk. (Established; No. 07 The Missing Ring-0 Protections for AI Agents)

WM-Basin flags 79% (n-gram=1) and 45% (n-gram=3) of distilled models at 0.1% FPR, vs 29% and 1.3% for the token-level baseline. (Established; No. 06 Black-Box Detection of Model Distillation using Watermark Basins)

Two epochs of reason SFT leave WM- Basin at 0% TPR at 0.1% FPR in all three windows (Table 7). (Established; No. 06 Black-Box Detection of Model Distillation using Watermark Basins)

Under reason SFT, GSM8K rises 1.0 to 4.8 points and Math-500 falls 1.1 to 3.6 (Table 17). (Established; No. 06 Black-Box Detection of Model Distillation using Watermark Basins)

GRPO leaves WM-Basin detecting every distilled model at 5% FPR. (Established; No. 06 Black-Box Detection of Model Distillation using Watermark Basins)

The paper's §3.3 says SFT does not move the model out of the basin; App. D.2 says the open-weight column shows memorized traces, not survival in the weights. (Established; No. 06 Black-Box Detection of Model Distillation using Watermark Basins)

Whether the watermark survives in the weights after reason SFT, on held- out prompts. (Unknown; No. 06 Black-Box Detection of Model Distillation using Watermark Basins)

Int8 and 10% pruning stay usable and cost detection at most three points; int4, nf4, 20% and 30% pruning fail the 0.9 utility gate. (Established; No. 06 Black-Box Detection of Model Distillation using Watermark Basins)

Cross-family probes lose little at n- gram=3, 0.1% FPR; distant vocabularies lose more (Table 14). (Established; No. 06 Black-Box Detection of Model Distillation using Watermark Basins)

Probe transfer against students from other families. (Unknown; No. 06 Black-Box Detection of Model Distillation using Watermark Basins)

p ≤ 0.001 requires at least 999 decoys. (Established; No. 06 Black-Box Detection of Model Distillation using Watermark Basins)

A 1,000-key bank costs about 450 GPU-hours on the paper's (unnamed) hardware; each audit about 1.6 GPU- hours. (Established; No. 06 Black-Box Detection of Model Distillation using Watermark Basins)

Table 8 counts ≈ 10M sampled and ≈ 1M scored tokens; App. B.4 calls ≈ 1M "sampled". (Established; No. 06 Black-Box Detection of Model Distillation using Watermark Basins)

The worst of 1,000 keys has 23.4– 26.2% FPR at a nominal 5% (Table 11). (Established; No. 06 Black-Box Detection of Model Distillation using Watermark Basins)

Certifying FPR ≤ 0.1% at 95% with zero false alarms takes 2,995 independent clean audits. (Established; No. 06 Black-Box Detection of Model Distillation using Watermark Basins)

A p-value doesn't measure effect size or importance, and by itself isn't a good measure of evidence about a hypothesis. (Established; No. 06 Black-Box Detection of Model Distillation using Watermark Basins)

Detection supports a terms-of-service claim better than an IP claim. (Best Guess; No. 06 Black-Box Detection of Model Distillation using Watermark Basins)

Every student in the paper was distilled on math. (Established; No. 06 Black-Box Detection of Model Distillation using Watermark Basins)

The planned study does not fit one A100 for three weeks at a 1,000-key bank. (Best Guess; No. 06 Black-Box Detection of Model Distillation using Watermark Basins)

28 of 38 provenance-era detector papers trust the evidence or scope out its manipulation (Established; No. 05 When clock uncertainty changes an incident verdict)

4 of 52 host-detector papers describe an input-ordering condition (Established; No. 05 When clock uncertainty changes an incident verdict)

None specifies validity conditions across delayed or missing records (Established; No. 05 When clock uncertainty changes an incident verdict)

No sampled system states a numeric clock-offset bound (Established; No. 05 When clock uncertainty changes an incident verdict)

Ledger's KAIROS clock evidence quotes a concept-drift passage; Q3 coded "not found" (Established; No. 05 When clock uncertainty changes an incident verdict)

KAIROS uses 15-minute time windows and anomaly queues (Established; No. 05 When clock uncertainty changes an incident verdict)

KAIROS ingests edges chronologically as they appear (Established; No. 05 When clock uncertainty changes an incident verdict)

OpTC: 500 of 1,000 hosts collected, ~1 TB compressed JSON, two weeks (Established; No. 05 When clock uncertainty changes an incident verdict)

OpTC release includes red-team ground truth (Established; No. 05 When clock uncertainty changes an incident verdict)

W32Time supports 1s, 50ms or 1ms tiers, each with its own requirements (Established; No. 05 When clock uncertainty changes an incident verdict)

WEF batching timeouts of 30s, 15min, 6h are configuration limits (Established; No. 05 When clock uncertainty changes an incident verdict)

ETW callbacks have out-of- order delivery exceptions (Established; No. 05 When clock uncertainty changes an incident verdict)

TCP orders bytes within a connection (Established; No. 05 When clock uncertainty changes an incident verdict)

Signed syslog detects tampering and loss, not delay (Established; No. 05 When clock uncertainty changes an incident verdict)

SLEUTH keeps per-subject order, ms timestamps in 16 bits (typical case) (Established; No. 05 When clock uncertainty changes an incident verdict)

ORTHRUS reports KAIROS node-level TP=0 on E5-CADETS and E5-THEIA (Established; No. 05 When clock uncertainty changes an incident verdict)

KAIROS GPU memory 2.26– 23.85 GB across DARPA E5 datasets (Established; No. 05 When clock uncertainty changes an incident verdict)

No public runnable SLEUTH artifact located (Unresolved; No. 05 When clock uncertainty changes an incident verdict)

Verdicts change away from window boundaries (H1) (Hypothesis; No. 05 When clock uncertainty changes an incident verdict)

KAIROS verdicts change only at window crossings (H2) (Hypothesis; No. 05 When clock uncertainty changes an incident verdict)

Streaming event-time detectors ignore pure delay (H3) (Hypothesis; No. 05 When clock uncertainty changes an incident verdict)

Cross-host chains are less stable than single-host chains (Hypothesis; No. 05 When clock uncertainty changes an incident verdict)

Attackers can induce collector delay (Hypothesis; No. 05 When clock uncertainty changes an incident verdict)

Timestamp error bars should be source-specific (Recommendation; No. 05 When clock uncertainty changes an incident verdict)

Procurement should ask for a time model declaration (Recommendation; No. 05 When clock uncertainty changes an incident verdict)

Baseline leak rates (Set 7) are 60.8% (RU), 58.3% (UK) (Established; No. 04 Does PII masking survive a different document generator?)

External dataset leak rates differ (0.7% RU, 4.0% UK) (Established; No. 04 Does PII masking survive a different document generator?)

99% is restoration threshold, not leak rate (Established; No. 04 Does PII masking survive a different document generator?)

Original acceptance criterion: ≤ 2% document leak (Established; No. 04 Does PII masking survive a different document generator?)

Corpus would be 600 documents (300 UK, 300 RU) (Author proposal; No. 04 Does PII masking survive a different document generator?)

Classifier AUC > 0.8 as a separability diagnostic (Proposed diagnostic threshold; No. 04 Does PII masking survive a different document generator?)

Seeding from ECHR/ TAB requires privacy audit (Proposed protocol safeguard; No. 04 Does PII masking survive a different document generator?)

pii-roundtrip leak rate higher on independent corpus than on Set 7 (Hypothesis; No. 04 Does PII masking survive a different document generator?)

Baselines leak ≥ 40% on independent corpus (Untested prediction; No. 04 Does PII masking survive a different document generator?)

998/1,000 UK non-leak is document metric (Established; No. 04 Does PII masking survive a different document generator?)

Russian name restoration failures are mainly inflection errors (Pending independent replication; No. 04 Does PII masking survive a different document generator?)

LLM does not see local vault mapping (Established; No. 04 Does PII masking survive a different document generator?)

UK GDPR: Article 6 basis; Article 9 condition only for special-category data; no leak threshold (Established; No. 04 Does PII masking survive a different document generator?)

Reversibly pseudonymised data remains personal data (Established; No. 04 Does PII masking survive a different document generator?)

Utility includes entity- role fidelity (Study-specific operational criterion; No. 04 Does PII masking survive a different document generator?)

max_length=512, stride=128 are default config (Environment/ YAML can override; No. 04 Does PII masking survive a different document generator?)

Vault implements AES-256-GCM with scrypt (Established; No. 04 Does PII masking survive a different document generator?)

Production reality limited to synthetic generator transfer (Not established by external sources; No. 04 Does PII masking survive a different document generator?)

Version drift may improve Russian restoration (Possible; No. 04 Does PII masking survive a different document generator?)

Local LLM may not simulate external services (Plausible confound, to be characterized; No. 04 Does PII masking survive a different document generator?)

Hypotheses

Claim: PhotoCraft 0.17.0's Linux updater verifies TLS through rustls-webpki 0.103.15. Falsifier: disassembly showing the update client's certificate verification does not reach that crate. Disproof: (No. 17 Mostly Harmless: a no-execution audit of PhotoCraft 0.17.0 for backdoors, phone-home and leaks)

Hypothesis, not execution-tested: PhotoCraft 0.17.0's Linux verifier may accept an otherwise valid api.github.com certificate chain through a compromised intermediate when its active trust store contains a suitable trust anchor and no applicable distrust mechanism rejects the chain. Falsifier: a test harness, run off-host, in which rustls- webpki 0.103.15 with rustls-platform-verifier 0.7.1 rejects such a chain. Disproof: (No. 17 Mostly Harmless: a no-execution audit of PhotoCraft 0.17.0 for backdoors, phone-home and leaks)

Claim: every registry crate and version identified in the recovered Linux binary source paths appears in Cargo.lock; this does not establish a complete inventory of compiled- in code. Falsifier: any embedded registry source path naming a crate and version not in the lockfile. Disproof: (No. 17 Mostly Harmless: a no-execution audit of PhotoCraft 0.17.0 for backdoors, phone-home and leaks)

H1 Among the paper's 1,228 Class A requests, fewer than 20% let the converted GET execute a client-requested unsafe effect: a committed change to stored data, account or session settings, or an external action, measured with the two-arm test from section 5 and judged by meaning, not by column name. That GET outcome is the primary one. Whether the POST acts, and whether both do, are reported beside it. Disproof: Sample sites, not requests, since requests on one site share code: draw at least 60 of the 407, test their requests with weights that restore the original request-level population, and use cluster-aware confidence intervals, reporting site, route and request counts separately. Test only on authorized replicas or with site owners' permission. A sampled request that can't be tested is reported as missing, never swapped for a convenient one, and if more than a fifth are missing, the result describes the tested sites only. If the 95% upper confidence bound on the unsafe share is below 20%, H1 is supported; if the lower bound is above 20%, it's falsified; otherwise it's inconclusive. The raw crawl is author-held, so this needs the authors. (No. 16 HTTP method equivalence is not state equivalence)

H2 In a pinned ModSecurity and CRS 4.x deployment, with explicit parsers for URL-encoded and JSON bodies, paired SQL injection payloads are blocked at the same rate in a GET query string as in a POST body, within 5 percentage points. Disproof: Use one payload corpus, each payload sent both ways, with known- benign and known-malicious controls in every run. The interval is computed on the (No. 16 HTTP method equivalence is not state equivalence)

H1 With the agent on host A and a tool gateway on host B serving two concurrent batch-synchronous sessions at ε = 0.2, each with a fresh per- call coin and a silent pre-commit audit, a held-out classifier given only the round makespan the agent can read predicts each session's own coin with 2a-1 of at least 0.10. The paper's noiseless value for this setup is 0.80. Disproof: Run at least 2,000 rounds, and split training from test data by round, never by session: the two sessions in a round share one makespan. If the 95% upper confidence bound on 2a-1 is below 0.10, H1 is falsified for this setup at this load. If the lower bound is above 0.10, H1 is supported. An interval that straddles 0.10 is reported as inconclusive, not as a failure. The same detector with both processes on (No. 15 Can agents tell when they are being audited?)

H1 Qwen3.8 27B gets the main point right on at least 85 percent of a prespecified 100-question set. Disproof: The upper bound of the 95 percent Wilson interval for main-point-right falls below 85 percent. If the interval straddles 85 percent, the result is inconclusive, not a pass. (Vendor: 21 of 22 main point right on its own set.) (No. 14 Assessing Offline LLM Efficacy for Emergency Operations)

H2 Among the models offered in v0.4.1, at a pinned configuration, no answer on a prospective, hazard-stratified question set is judged severely harmful by two clinicians using a rubric fixed in advance. Disproof: At least one answer judged severely harmful by both clinicians. (Zero harmful answers in about 60 questions per hazard category bounds the rate below 5 percent only for questions like those; it is not a safety certificate. The 3B model, already disclosed and withdrawn, is out of scope.) (No. 14 Assessing Offline LLM Efficacy for Emergency Operations)

H3 Fewer than 5 percent of displayed answers attach a source that doesn't support the claim it's attached to (Source Seen but not Source Supports), counted separately from sources the app repaired. Disproof: The lower bound of the 95 percent interval for that rate, per answer, is above 5 percent. (No. 14 Assessing Offline LLM Efficacy for Emergency Operations)

H4 The 27B model on a 32 GB Mac completes 100 queries without running out of memory or offloading to the CPU more than half the time. (Energy per correct answer is measured separately, with a wattmeter; it is a measurement, not this claim.) Disproof: Out of memory, or more than 50 percent CPU offloading, during the 100- query run. (No. 14 Assessing Offline LLM Efficacy for Emergency Operations)

H5 In a randomized replay (same questions, weights, settings, library snapshot and rubric), the answer-anyway rule produces a higher rate of unsupported factual assertions than an abstain-or-escalate rule. Disproof: The difference in that rate (percentage points, answer-anyway minus abstain) has a 95 percent interval entirely below a margin fixed before the run, such as 5 points. (No. 14 Assessing Offline LLM Efficacy for Emergency Operations)

C1: The Confound Hypothesis Disproof: At 4–8 bits, a post-training-quantized model shows no meaningful reduction in membership-attack success relative to full-precision controls selected to match its validation accuracy. (No. 13 Quantization is not a privacy guarantee)

C2: The Low-Bit Hypothesis Disproof: The reductions reported at 2 bits shrink when the comparison is a full- precision model matched for validation accuracy rather than the original full- precision model. (No. 13 Quantization is not a privacy guarantee)

C3: The LLM Generalization Hypothesis Disproof: Within each system, the effect of 4-bit quantization on membership leakage, measured against a validation-matched control, points the same way in a language model as in a vision classifier. (No. 13 Quantization is not a privacy guarantee)

Claim: A distro package marked "Fixed" ships firmware with the overflow fix in both ICMP error handlers. Disproof: Analysis of that package's OVMF_CODE.fd shows either handler still copies without clamping to the space left, or still advances by the cumulative length. One such package is enough. A missing ZeroMem call alone does not count. (No. 12 EDK II PXE bug: which shipped firmware and VM images actually contain the fix?)

Claim (hypothesis): On a given cloud, instances started after the provider's firmware update boot fixed firmware, and instances started before it do not. Disproof: In a sample fixed in advance (one instance type, started before and after the provider's announced update), firmware identified by a provider-attested method is the same in both groups. With no such method, the claim can't be tested from the tenant side, and that is the finding. (No. 12 EDK II PXE bug: which shipped firmware and VM images actually contain the fix?)

Claim (hypothesis): Amazon Linux 2023's edk2 is Not Affected because its build leaves out UefiPxeBcDxe. Disproof: The OVMF image in the AL2023 edk2 package contains the module GUID. The status would then rest on something else, such as a backport. (No. 12 EDK II PXE bug: which shipped firmware and VM images actually contain the fix?)

Claim: A SUSE ovmf package marked Affected, under the overall "Pending" state, ships firmware without the fix. Disproof: Binary analysis of one such package finds the fix in both handlers. (No. 12 EDK II PXE bug: which shipped firmware and VM images actually contain the fix?)

H1 At least 2% of reachable help centres in the frame carry AI-addressed text a visitor isn't shown. This is a decision threshold, not a prediction. Below 2%, WhatsApp looks like an outlier. At 2% or more, it's a practice. Disproof: 8 or more positives in 200 (lower bound 2.01%). (No. 11 Written for the Chatbot, Sent to Everyone: auditing the text help pages carry for machines)

H2 In most known positives, the AI-addressed text is in what a browser gets. It's hidden by rendering, not served only to claimed crawler names. The basis is WhatsApp's notes, which arrived in every browser's JSON, and Lorikeet's sections, hidden by style on pages any visitor loads. Disproof: The interval for the share present in browser responses lies entirely below 50%. With 20 positives, that means 5 or fewer, and 15 or more confirms. Fewer than 20 known positives means the claim goes untested. (No. 11 Written for the Chatbot, Sent to Everyone: auditing the text help pages carry for machines)

H3 Across positives, the article extractors tested in section 4, at default settings on raw HTML, return the AI-addressed text in fewer than half of cases. Disproof: The interval for that survival rate lies entirely above 50%. (No. 11 Written for the Chatbot, Sent to Everyone: auditing the text help pages carry for machines)

H1 Across the validation corpus, in every build where the control string is present, _ERROR_FORMAT_BLOCK_SWITCH is present if and only if the build has the fix, with at least 300 such builds. Disproof: A single build where the string's presence disagrees with the source it was built from. This is an invariant, not a rate: one counterexample is enough. (No. 10 Broccoli2Shell: counting vendored Brotli decoders hiding in the software supply chain)

H2 Among census artifacts where a Brotli C decoder is found, at least 10% still lack the fix on the census date. This is a decision threshold, not a prediction. At 10% or more, a binary check belongs in release gating. The basis for expecting a tail is the list of projects still unpatched on 25 October. Disproof: The interval for the vulnerable share lies entirely below 10%. (No. 10 Broccoli2Shell: counting vendored Brotli decoders hiding in the software supply chain)

H3 Among tier-C artifacts the census confirms vulnerable, Syft with its binary catalogers enabled lists no Brotli component for at least half. The basis is that Syft has no Brotli classifier. Disproof: The interval for that miss rate lies entirely below 50%. (No. 10 Broccoli2Shell: counting vendored Brotli decoders hiding in the software supply chain)

H1 In the rebuilt four-cut harness, Flash-Next's URL-writing rate at the -o cut exceeds its rate at the -m 10 cut by at least 50 percentage points. Disproof: The interval for that difference lies entirely below 50 points. (No. 09 What a Local GPU Can and Can't Check About Qwen3.8's Phone-Home URLs)

H2 At the -o cut, swapping the CTI-REALM task for one with no download theme lowers Flash-Next's URL-writing rate by at least 30 points. Disproof: The interval for the drop lies entirely below 30 points. (No. 09 What a Local GPU Can and Can't Check About Qwen3.8's Phone-Home URLs)

H3 At the -o cut, Flash-Next names a watchlist host in at least 10% of completions, while Qwen3.8-27B in the same harness stays below 5%. Disproof: Flash-Next's interval lies entirely below 10%, or 27B's lies entirely above 5%. (No. 09 What a Local GPU Can and Can't Check About Qwen3.8's Phone-Home URLs)

H4 Handed Cohere's reasoning that concludes no tools are needed, Flash-Next issues a tool call in at least 95% of completions. Disproof: The interval lies entirely below 95%. Either way, this measures how well stated intentions predict behavior. It says nothing about whether anything was intended. (No. 09 What a Local GPU Can and Can't Check About Qwen3.8's Phone-Home URLs)

H1 On paired tasks with the attack text fixed, moving the injection from an untrusted tool result into a trusted assistant turn raises attack success on HoS-gated GPT-OSS-20B by at least 10 percentage points (B − A ≥ 10) at each of the two released learning rates tested, 0.01 and 0.1. Disproof: B − A is below 10 points at either learning rate. What a small gap would mean (gates that protect more than the label, a base model that resists this attack anyway, or too few tasks) is read from the undefended runs and the confidence intervals, not assumed. (No. 08 Architectural Defenses Against Prompt Injection)

H2 At least half of the relabeling effect survives summarization: (C − A) ≥ 0.5 × (B − A), at each learning rate where H1 holds. Disproof: (C − A) is below half of (B − A) at any such learning rate. If H1 fails, H2 isn't tested. (No. 08 Architectural Defenses Against Prompt Injection)

H3 Condition D brings attack success back to within 5 points of A (D − A ≤ 5), with clean task success no more than 5 points below C, both judged on the bounds of paired 95% confidence intervals. Disproof: The interval for D − A extends above 5 points, or the interval for the clean- success loss extends past 5 points. (No. 08 Architectural Defenses Against Prompt Injection)

H4 On the prefill-heavy workload, losing the prefix cache (E0 − E1) adds more median time to first token than the gated kernel (V − E0) and CUDA graphs (E1 − S) each do. Disproof: Either of the other two differences is larger. A result with no detectable difference isn't a disproof of cost: if the interval is wide enough to include a slowdown that matters at your traffic, the study was too small. (No. 08 Architectural Defenses Against Prompt Injection)

H1 With staged effects and executor-held credentials, the supervisor commits zero unauthorized effects across at least 500 attack episodes spread over at least five attack paths, while task success stays within 5 percentage points of the ordinary-permissions baseline. Disproof: Any committed unauthorized effect, or task success more than 5 points below baseline. (No. 07 The Missing Ring-0 Protections for AI Agents)

H2 At least 90% of the side-effecting tool calls in the repository task set can be staged (overlay, held push, held request) without breaking the task. Disproof: More than 10% of side-effecting calls can't be staged, or staging costs more than 5 points of task success. (No. 07 The Missing Ring-0 Protections for AI Agents)

H3 At least one class of attack in the suite is blocked by the Commit Boundary configuration and admitted by both the CXI-style and Concordat- style configurations. The candidate is an authorized tool called with an attacker-chosen argument, backed by evidence the agent fetched itself. Disproof: Every attack the Commit Boundary configuration blocks is also blocked by at least one of the existing configurations. (No. 07 The Missing Ring-0 Protections for AI Agents)

H4 No protected effect is reachable without passing the supervisor, via the shell, a restored session, a sub-agent, a background process or a replayed request. Disproof: One such path. This is an invariant to attack, not a rate to estimate: passing tests can't prove it, and a single counterexample breaks it. (No. 07 The Missing Ring-0 Protections for AI Agents)

H1 Two epochs of the paper's reason-SFT recipe take WM- Basin to at most 6% TPR at 5% FPR, while GSM8K accuracy doesn't fall. Disproof: WM-Basin keeps more than 20% TPR at 5% FPR after the same recipe, on the paper's stated settings (App. D.2). (No. 06 Black-Box Detection of Model Distillation using Watermark Basins)

H2 Int8 quantization after the multilingual SFT arm takes WM-Basin below 10% TPR at 5% FPR while the model stays above the 0.9 utility gate. The paper reports each operation on its own. Disproof: WM-Basin stays within three points of the multilingual arm alone, as int8 does on the unmodified students. (No. 06 Black-Box Detection of Model Distillation using Watermark Basins)

H3 On a Llama-family student cohort, swapping between Qwen and Llama probes moves TPR at 0.1% FPR by more than the 20-point spread Table 14 shows among Qwen probes on Qwen students. Disproof: The swap stays within that spread. (No. 06 Black-Box Detection of Model Distillation using Watermark Basins)

H4 Key-specific detection transfers to students distilled on code rather than math, audited on code. Every student in the paper was distilled on math. Disproof: Code-distilled students audited on code stay at chance. (No. 06 Black-Box Detection of Model Distillation using Watermark Basins)

H5 After the reason-SFT arm, a white-box read on held-out prompts still separates keyed from clean students at p ≤ 0.01. Disproof: The held-out read loses discrimination along with the black-box one, which would mean the open-weight column was reading memory. (No. 06 Black-Box Detection of Model Distillation using Watermark Basins)

H1 Away from window boundaries, verdict consistency still shows steps: at least 10 percentage points of change within 100ms of perturbation. Disproof: Across a dense sweep with the baseline gate passed, smooth models are preferred over change-point models for runs where no attack edge crosses a window boundary. (No. 05 When clock uncertainty changes an incident verdict)

H2 KAIROS's chain-level verdicts change only when attack edges cross 15-minute window boundaries. Disproof: Verdict change beyond baseline seed variance in runs where no attack edge crosses a boundary. (No. 05 When clock uncertainty changes an incident verdict)

H3 A streaming detector that orders by event time is unaffected by delivery delay alone. Disproof: Its chain-level verdicts change under delay-only perturbation with embedded timestamps held fixed. (No. 05 When clock uncertainty changes an incident verdict)

H1 pii-roundtrip's benchmark-defined document-leak rate is higher on the independent corpus than on held-out Set 7. Disproof: Support H1 if the lower 95% confidence bound of the rate difference exceeds zero. Report the independent-corpus rate against this proposal's 1% target separately: below 1% only if the upper bound is below 1%, above 1% only if the lower bound exceeds 1%, otherwise inconclusive. Prespecify sample size through power analysis. (No. 04 Does PII masking survive a different document generator?)

H2 Russian name restoration accuracy is ≥ 95% on independent corpus (v0.5.0 and patched releases scored separately). Disproof: Find evidence against accuracy of at least 95% if the upper 95% confidence bound is below 95%; support the target if the lower bound is at least 95%; otherwise report inconclusive. Classify error causes separately. (No. 04 Does PII masking survive a different document generator?)

H3 On the same independent-corpus documents, each prespecifiedPresidio and GLiNER configuration leaks more than pii-roundtrip. The ≥ 40% level is a secondary, untested prediction. Disproof: Support H3 for a configuration if the lower 95% confidence bound of its paired leak-rate difference against pii-roundtrip exceeds zero. Assess the 40% level as H1 assesses the 1% target: a lower bound above 40% supports it, an upper bound below 40% counts against it, otherwise inconclusive. Account for multiple configuration comparisons. (No. 04 Does PII masking survive a different document generator?)

H4 Attacker-influenced LLM responses cause local restorer to emit real PII in new contexts. Disproof: Fictional identities and controlled recipients only. Count placeholders as in How to, below. Call an event exfiltration only with demonstrated attacker influence, restoration behavior, and an unauthorized destination. (No. 04 Does PII masking survive a different document generator?)