Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-05 · high
Researchers disclosed the gap and are pushing a two-part fix upstream into the reference scheme, per the paper.
Why now: The paper is part of the August 5 research briefing, examining the same reference scheme meant to anchor AI agent action logs in hardware trust.
Project Veraison's reference attestation scheme marks a replayed TPM quote as affirming, according to a paper posted to arXiv.
That's the mechanism meant to certify an AI agent's action log hasn't been altered after the fact. If a stale quote appraises the same as a fresh one, an audit trail built on it can't tell a live measurement from a replay.
The scheme binds the log's outcome digest into a hardware-rooted TPM quote, then checks it through a RATS-compliant verifier under RFC 9334.
The tampering checks work. Swap the recorded outcome, or flip one byte in the digest, and the verifier correctly returns contraindicated, per the paper.
What it doesn't check is whether the quote answers the challenge nonce it was just handed. An old, previously-valid quote still appraises as affirming even when nothing about the current state matches it.
The researchers disclosed the gap responsibly and describe a two-part fix meant to go upstream into the reference scheme.
Each link below shares sources, entities, or timing with this story.
Shared entity: RFC / Earlier coverage / Tension
Both cover RFC; earlier RFC coverage from 2026-07-31; pushes against this story (against).
Shared entity: Good / Earlier coverage / Tension
Both cover Good; earlier Good coverage from 2026-07-19; pushes against this story (but).
Both cover Good; earlier Good coverage from 2026-06-22; pushes against this story (skeptical).
Shared entity: RfC / Earlier coverage / Downstream implication
Both cover RfC; earlier RfC coverage from 2026-03-21; traces where this leads (downstream).
Shared entity: Good / Tension
Both cover Good; pushes against this story (against).
Same source domain / Shared topic
Reported by the same outlet (arxiv.org); overlapping topics (agent, bind).
Reported by the same outlet (arxiv.org); overlapping topics (accept, agent).
Reported by the same outlet (arxiv.org); overlapping topics (agent, bind).