ResearchShadow APIs Real Money Fake Models 47 Percent Performance DivergencearXiv·high signal17 shadow APIs audited across 187 academic papers. Up to 47.21% performance divergence from official APIs. 45.83% identity verification failure.SourceSource pagearXiv↳ Follow the threadStack layer / Threat patternMCPZoo Study: Scanners Call 96.89% of MCP Servers 'Risky' — But Under Half of Those Alerts Are RealarXivStack layer / Threat patternStudy of 44 Developers: AI Code Assistants Barely Improve Secure API UsagearXivStack layer / ContrastLong-Horizon-Terminal-Bench: Best Frontier Agent Clears Just 15% of Real Terminal Tasks, Mean 4.3%arXiv (Tencent Hunyuan) / HuggingFace Daily PapersStack layerDistributed Backdoors Prove Per-Step Agent Monitors Can Be Right on Every Step and Still Miss the AttackarXivStack layer'Coding Agents Think Ahead of Time': Latent Probes Predict Outcomes 25 Steps EarlyarXiv / Hacker NewsStack layer'Who Broke the System?' AgentLocate Pinpoints the Failing Agent and Step in Multi-Agent RunsarXivStack layer / Threat patternMako: A 'Self-Evolving Agentic OS' That Writes New Exploits Against Live Targets and Hot-Loads Them Into ItselfarXivContrastHow 20 Practitioners Actually Build SE Agents: A Mixed-Methods Study of the Undocumented CraftarXiv