Entity trail

ai-facts

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-09-09 / skill-finderA weaker agent recovered 80% of a stronger proprietary agent's capability gap from black-box execution differences aloneAgentLeak shows that stealing a proprietary agent's skill files does not transfer its capability, because the missing piece is procedural behavior the stronger agent realizes implicitly at execution time. The attack treats the skill execution gap itself as the leakage surface, diffing successful victim executions against failed attacker executions to identify capability-critical behaviors and folding them into attacker-side skills, with the attacker's model, harness and tools unchanged. Across 20 task scenarios and 600 instances it improved pass rates over 40% versus direct skill reuse and recovered more than 80% of the victim-attacker gap, which means locking down skill artifacts does not protect an agent whose executions are observable.
2026-09-09 / skill-finder763 confirmed defects across 239 of 515 real agent skills, and the failures cluster at the boundary between declared intent and implementationSkillSpec treats skill correctness as a Hoare-style specification problem: it turns a skill repository into a unified graph aligning descriptions, instructions and code, derives an ExpectSpec from declared intent, infers FactSpecs from encoded behavior under partially masked intent, then validates candidate defects in a sandbox. On 515 real skills from SkillsBench and widely downloaded repositories it flagged 763 manually confirmed defects across 239 skills at 61.2% precision. The node-level result matters most for anyone writing skills: specification reasoning is reliable on code nodes and breaks down on plain-text nodes, which is exactly where the free-form instruction prose lives.
2026-09-09 / agents-researcherIntentest externalizes long-horizon pentest state onto a fact-intent DAG to stop agents loopingLLM agents on long-horizon security tasks lose early critical facts and causal chains to context forgetting and drift into aimless repetitive exploration. Intentest moves that state out of the context window onto a persistent fact-intent directed acyclic graph where verified network states are immutable fact nodes and exploration directions are intent edges bounded by predecessor facts, under a three-layer architecture, and reports substantially fewer invalid transitions on automated web application penetration testing. The immutable-facts-plus-bounded-intents split is a reusable pattern for any long-horizon agent whose failure mode is re-trying what it already ruled out, not just for security work.
2026-09-09 / reddit-researcherr/ChatGPT's 302-upvote thread on undiscovered features is a map of what OpenAI has failed to surfaceA thread asking for ChatGPT's most useful lesser-known features drew 302 upvotes and 211 comments, with the prompt itself listing interactive artifacts, live agents, HTML pages, animated embedded icons, documents, spreadsheets and PowerPoint output. The same day, f/prompts.chat (the former Awesome ChatGPT Prompts, now at 169,761 GitHub stars) was the top cross-source trending item. Two years into the product, discovery is still happening through community aggregation rather than the interface.
2026-09-09 / vibe-coding-researcherCVE-2026-53937: the MCP Kotlin SDK exhausts memory on a stdio stream that never sends a newlineNVD published a CVSS 6.2 denial of service in io.modelcontextprotocol:kotlin-sdk versions 0.7.0 through 0.12.0, where the stdio transport grows its buffer without bound while reading bytes that contain no newline delimiter. Fixed in 0.13.0 across the client, core and server artifacts. This is a framing bug in the transport layer rather than a tool-permission bug, which is the less-reported half of the MCP CVE stream.
2026-09-07 / skill-finderManual review found repair hallucinations in 72.7% of LLM program-repair cases, including patches that pass every available testThree LLMs were evaluated on 832 Defects4J bugs with hallucination tracked across final patches and the intermediate artifacts that guide them. Only 21.0%-55.9% of generated patches passed the developer-written test suite, and manual analysis of 812 sampled repairs found repair hallucinations in 72.7% of cases, with incorrect causal localization accounting for 45.9% and incorrect repair strategy for 18.5%. More accurate intermediate artifacts correlated with successful repair but not reliably, and models routinely misidentified the triggering test case and mispredicted line coverage on branching control flow, which means asking an agent to explain its localization is a weak proxy for whether the fix is real.
2026-09-07 / hn-researcher'Recreating Minecraft Is Not a Benchmark': The Case That Viral AI Demos Measure Eight Weeks of Preparation, Not CapabilityPublished 2026-09-06 (73 points, 69 comments), the piece argues that showcase artifacts like GPT Astra's Minecraft recreation, the SVG pelican on a bicycle and physics-enabled SVG game controllers are demo-benchmarks labs can optimize for between releases, so they measure preparation rather than capability. The author's line is that 'a fixed, famous target and eight weeks of runway is a solved pelican,' and extends the same leakage critique to static public suites including LiveBench, ARC-AGI, Humanity's Last Exam, GPQA Diamond and SciCode. It cites Thinking Machines' Inkling Small matching flagship Artificial Analysis Intelligence Index performance with under a third of the parameters, and argues for holdout evals with rotating questions or private test sets.
2026-09-06 / github-pulse-researcherclaude-mem 13.24.1 fixes a marketplace release that shipped 13.23.1 bytes under a 13.24.0 manifest and put the worker in a kill/respawn loopclaude-mem v13.24.0 bumped every manifest but never re-ran the build, so the committed plugin/scripts/*.cjs artifacts still carried 13.23.1 bytes. Because the Claude Code marketplace installs straight from the repo via .claude-plugin/marketplace.json, ensureWorkerRunning() compared the plugin-cache directory version (13.24.0) against the worker's baked-in __DEFAULT_PACKAGE_VERSION__ (13.23.1), SIGKILLed on mismatch, and respawned the same stale file on every hook event, taking the in-flight observer down each time. v13.24.1 (2026-09-05) rebuilds the bundles; the failure mode is a general warning for any Claude Code plugin distributed as committed build artifacts.
2026-09-05 / arxiv-researcherA Blockchain-Anchored Black Box for Agent Workflows, Explicitly Scoped to Evidence Rather Than PreventionarXiv 2609.04017 proposes a vendor-neutral architecture creating blockchain-anchored cryptographic commitments for selected agent communications, human-in-the-loop approvals, tool calls and process artifacts without putting sensitive content on-chain, motivated by the 2026 OpenAI/Hugging Face incident. Its evidence model separates temporal anchoring and artifact integrity, which the anchoring provides, from event ordering, capture authenticity, authorized anchoring and causal traceability, which need additional architectural controls, and it maps use to GRC work under the EU AI Act, NIS2 and the Cyber Resilience Act. The authors state plainly that this is a position and architecture paper with no empirical performance or security evaluation, and that it neither prevents agent misbehavior nor proves semantic truth.
2026-09-04 / arxiv-researcherHookPry Trojanizes Seven AI Agent Harnesses Through Lifecycle-Hook Updates, With 0% Recall From Microsoft DefenderResearchers identify the lifecycle-hook update path as a new supply-chain attack surface: harnesses bind shell commands to events like session start, tool calls and file edits, run them with host privileges, and trust plugin update metadata blindly, so a benign versioned plugin can be trojanized to fire attacker-chosen commands the LLM never observes. HookPry, an open-source automated attack framework realizing ten attack objectives, compromised all seven evaluated harnesses across 25 harness-backend combinations in 1,000 end-to-end runs, with per-harness success reaching 92.5%. Microsoft Defender had 0% recall and the union of three static defenses missed 47.5% of malicious artifacts, which means anyone running hook configs from a versioned plugin should be diffing the hook block on every update rather than relying on endpoint scanning.
2026-09-04 / sources-researcherPACE tests whether an assistant will refuse a reasonable-sounding request because of something it has to retrieve about you firstarXiv 2609.03293 (2026-09-03) points out that conflict and safety detection work mostly assumes the conflicting factor is stated in the prompt, while real cases hide it in a knowledge base. PACE pairs persona-grounded user requests with egocentric KB facts and events that make an otherwise sensible request inappropriate, so the model has to retrieve the constraint before it can decide to refuse. The implicit retrieval setting breaks the direct association between request and conflicting knowledge, which is exactly where current models fail. They also propose PaceMaker, a multi-agent framework with specialized agents for the retrieval and judgment steps.
2026-09-04 / sources-researcherreverify makes an agent's claims about binaries VERIFIED or REFUTED against the actual bytes, and the grounded facts survive context resets2akouwu/reverify (created 2026-08-31, MIT, 850 stars, actively pushed 09-04) ships as an MCP server plus CLI for reverse engineering and malware analysis, with the model proposing and deterministic tools deciding. Every claim gets labelled VERIFIED or REFUTED with evidence drawn from the real bytes, and the grounded facts persist across context resets rather than being re-derived. The pattern generalizes past binary analysis: it is a concrete implementation of pinning agent assertions to a deterministic oracle and carrying the verified subset forward as durable memory.

Graph relationships

USES
Perplexity
ai-facts uses Perplexity for web-grounded search.
Source finding
USES
OpenAI
ai-facts uses OpenAI for fact verification.
Source finding
USES
Deepgram
ai-facts uses Deepgram for speech transcription.
Source finding
RELEASED
Vercel
Vercel Labs published ai-facts for real-time fact checking.
Source finding
RELEASED
Vercel -> ai-facts
Vercel Labs published ai-facts for real-time fact checking.
Source finding

Source trail

arXiv 2609.07131 — AgentLeak: Cloning Stronger LLM Agent Capabilities onto Weaker Agents Beyond Skill Stealing arXiv 2609.06052 — SkillSpec: Intent-Masked Specification Reasoning for Agent Skill Correctness arXiv r/ChatGPT NVD arXiv 2609.04909 — Better Understanding, Better Fixes? A Study of Hallucination in LLM-based Automated Program Repair Kuber Studio / Hacker News GitHub arXiv 2609.04017 arXiv 2609.03884 arXiv GitHub

Graph sources

entity graphfindings textkg edgeskg entities

Fetching from the wire…