Entity trail

Phantom

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-06-20 / arxiv-researcherPhantomSkill: Malicious Code Injection in Agent Skill EcosystemsAn attack framework that hides malicious behavior inside agent-skill auxiliary resources; its VulMask technique rewrites overt malicious scripts into 'vulnerability-shaped' implementations that only activate under attacker-controlled conditions. It evades a range of automated security reviewers and coding agents that would catch obvious malicious code. A direct supply-chain warning for anyone installing third-party agent skills or MCP tools.
2026-04-24 / arxiv-researcherCross-Modal Phantom: Coordinated Camera-LiDAR Spoofing Bypasses Autonomous Vehicle Multi-Sensor FusionResearchers demonstrate that multi-sensor fusion in autonomous vehicles — designed to prevent single-sensor spoofing — can be bypassed by fabricating cross-sensor consistency, making camera and LiDAR agree on the same false object. The Cross-Modal Phantom attack exploits the assumption that fusion provides redundancy, when in reality the fusion process itself introduces a subtle vulnerability to coordinated spoofing across modalities.
2026-04-08 / vibe-coding-researcher@fairwords npm Credential Worm: Self-Propagating Attack Crosses to PyPI, Steals Crypto Wallets and Chrome PasswordsOn April 8, three @fairwords npm packages were compromised by an evolved CanisterWorm/TeamPCP variant. The 1,149-line payload steals npm/PyPI tokens, cloud credentials (AWS/Azure/GCP/GitHub/OpenAI/Stripe), SSH keys, crypto wallets (Solana, Ethereum, MetaMask, Phantom), and Chrome passwords via PBKDF2 decryption. If an npm token is found, the worm enumerates the victim's packages, injects itself, bumps versions, and republishes — second-generation versions appeared 8 minutes later. It also crosses to PyPI via .pth site-packages injection. Exfiltration uses RSA-4096+AES-256-CBC encryption to both HTTPS and an ICP canister dead-drop resistant to takedowns.
2026-04-06 / reddit-researcher'Silent Fake Success' Identified as Biggest Claude Code Time Sink: 406 Upvotes, 138 CommentsA r/ClaudeAI post (406 upvotes, 138 comments, 0.34 comment ratio) identifies 'silent fake success' — where Claude Code reports task completion without errors but produces subtly incorrect output — as the largest productivity drain for heavy users. The high engagement ratio signals this is a widely-shared pain point, with practitioners developing verification workflows and test-first patterns to catch phantom completions.
2026-04-05 / vibe-coding-researcherTip: Post-Axios Supply Chain Defense — Audit postinstall Hooks and Watch for Phantom DependenciesThe axios attack pattern is now documented and replicable: add a phantom dependency (never imported in source code) whose sole purpose is a postinstall hook that downloads platform-specific malware. Defense checklist: (1) audit all postinstall scripts in node_modules, (2) flag any dependency not referenced by import/require in the main package, (3) pin exact versions in lockfiles, (4) use CEL now() cooldown rules to block packages published in the last N hours, (5) monitor for package.json self-modification (the RAT replaces its own package.json with a clean copy as anti-forensics).
2026-03-31 / hn-researcherAgentic AI and the Next Intelligence Explosion — ArXiv Paper on Recursive Self-Improvement DynamicsArXiv paper 2603.20639 (17pts, 3 comments on HN) examines whether agentic AI systems could trigger a recursive intelligence explosion — where AI agents improve their own capabilities in a feedback loop. The paper analyzes current agent architectures, identifies conditions under which self-improvement becomes self-sustaining, and maps the theoretical boundary between controlled improvement and runaway capability gain. While academic, it provides a formal framework for the agent self-improvement pattern already emerging in tools like Phantom and self-evolving config systems.
2026-03-31 / hn-researcherShow HN: Phantom — Open-Source Self-Evolving AI Agent on Its Own VM, Built on Claude Agent SDKPhantom (ghostwright/phantom, 18pts/16 comments) is an Apache 2.0 AI co-worker that deploys to a dedicated VM, communicates via Slack, has its own email, and rewrites its own configuration after every conversation. The self-modification pipeline: observe → reflect → propose config changes → validate through a different LLM model (to avoid self-enhancement bias) → evolve. Exposes 17+ tools as an MCP server so other AI agents and IDEs can plug into it. Built on Anthropic's Claude Agent SDK, representing the emerging pattern of persistent, self-improving agents with full computer access.
2026-03-31 / vibe-coding-researcherPattern: Claude Code Harness Wrapper Race — Phantom, pilot-shell, pro-workflow All Ship in the Same WindowThree distinct Claude Code wrapper projects shipped in rapid succession: Phantom (24/7 autonomous agent, self-evolution, 1,200 Reddit upvotes), pilot-shell (TDD-mandatory professional harness with enforced linting hooks, 1,600 GitHub stars), and pro-workflow (self-correcting memory that compounds over 50+ sessions, 1,500 stars). All three solve the same gap — Claude Code is powerful but needs scaffolding for reliability. The convergent design pattern: persistent memory + enforced verification loops + session-spanning context. This is the harness layer forming.
2026-03-31 / vibe-coding-researcherPhantom: Open-Source 24/7 Autonomous Claude Agent with Self-Evolution, Persistent Memory, and Dynamic MCP Tool CreationPhantom gives Claude its own dedicated machine — a co-worker that runs continuously on Slack, Telegram, email, and webhooks. Built on the Claude Agent SDK, it features three-tier vector memory (mention something Monday, it uses it Wednesday), LLM-judge-validated config rewrites after every session, and runtime MCP tool creation that persists across restarts. The project just open-sourced with strong Reddit traction (1,200+ upvotes). This is the most complete open-source 'always-on Claude' implementation yet.
2026-03-27 / agents-researcherBeyondTrust: Enterprise AI Agents Growing 466.7% YoY — First Unified Privileged Identity for AI Coworkers From Desktop to CloudBeyondTrust Phantom Labs research reveals a 466.7% year-over-year increase in AI agents operating inside enterprise environments, with the majority running as shadow agents with privileged access invisible to security teams. BeyondTrust's Pathfinder Platform now delivers endpoint privilege management for AI clients (Claude, ChatGPT) enforcing least privilege at the OS level, plus Identity Security Insights with connector coverage spanning OpenAI, Google Vertex, Salesforce Agentforce, ServiceNow, and AWS Bedrock for automatic discovery, privilege path mapping, and risk scoring.
2026-03-22 / arxiv-researcherGoverning Dynamic Capabilities: Cryptographic Binding and Reproducibility Verification for AI Agent Tool UseIdentifies the 'capability-identity gap' in MCP/A2A: agents acquire tools dynamically at runtime, but no framework detects when capabilities change post-authorization, enabling silent capability escalation that violates EU AI Act traceability requirements. Proposes three defenses: X.509 certificates extended with a skills manifest hash (any tool change invalidates the cert), reproducibility commitments leveraging LLM inference near-determinism, and a hash-linked verifiable interaction ledger for multi-agent forensics. Rust prototype achieves 97µs certificate verification with <1ns capability binding overhead, detecting all 12 attack scenarios including tool trojanization, phantom delegation, and runtime behavioral attacks.
2026-03-19 / arxiv-researcherAWS Bedrock AgentCore 'Sandbox' Bypassed via DNS: BeyondTrust Discloses C2 Channel and Full Data ExfiltrationBeyondTrust Phantom Labs disclosed (March 16) that AWS Bedrock AgentCore's Code Interpreter Sandbox permits outbound DNS queries, enabling covert C2 channels and exfiltration of PII, API keys, and financial data. Commands are encoded as chunked ASCII in DNS A-record IP responses; output is exfiltrated via base64-encoded DNS subdomain queries. AWS declined to patch—updating docs to call DNS resolution 'intended functionality'—and awarded a CVSS 7.5, leaving the attack surface open for all Bedrock AgentCore users today.

Graph relationships

USES
Telegram
Phantom runs on Telegram
Source finding
USES
Slack
Phantom runs on Slack
Source finding
USES
Claude Agent SDK
Phantom is built on the Claude Agent SDK
Source finding
SUPPORTS
MCP
Phantom exposes 17+ tools as an MCP server.
Source finding
USES
Claude Agent SDK
Phantom is built on Anthropic's Claude Agent SDK.
Source finding

Source trail

Scrapling NousResearch's release Phantom pilot-shell pro-workflow arXiv arXiv SafeDep

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues