{ "publisher": "Lugano Labs", "url": "https://lugano.ai/research/", "evidence_types": { "official": "standards, specifications, official guidance, government and regulator records, statutes, court records", "first-party": "a company's own documentation, disclosures, statements and post-mortems about its own systems", "research": "published research: peer-reviewed papers, preprints, benchmarks, evaluations, independent audits and analyses", "reporting": "news reports, surveys, market data and secondhand summaries", "our-study": "our own scans, checks and measurements, with their records", "our-design": "our own drafts, specifications and prototypes", "our-analysis": "our reading, inference or assessment of the cited sources", "proposal": "part of a study or protocol we propose and have not run" }, "note": "Claims as stated in each page's claim ledger. Each claim has a stable id (the page slug and a hash of its wording), one evidence type and the page's own label for it (kind). Each source entry links the document the claim rests on; read the page for the claim in context and its limits. A page typed \"note\" is the short version of a full essay and repeats some of its claims.", "pages": [ { "slug": "agent-trust", "title": "Who remains in control when an agent acts?", "url": "https://lugano.ai/research/agent-trust/", "published": "2026-11-01", "revised": "2026-11-04", "in_short": "Anthropic’s telemetry showed Claude Code users approved roughly 93% of permission prompts, and approval fatigue showed up within weeks. A careful reader can approve exactly the right thing, and the action that reaches the world can still be a different one. So make the approval name the recipient, amount, expiry and policy version, and have the tool refuse any call that doesn’t match.", "claims": [ { "id": "agent-trust-7155eafb", "claim": "Indirect prompt injection can use retrieved untrusted content to influence an LLM-integrated application’s functionality and API use.", "evidence_type": "research", "kind": "reported", "section_url": "https://lugano.ai/research/agent-trust/#the-call-that-looks-valid", "sources": [ { "id": 1, "title": "Not what you’ve signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection", "author": "Kai Greshake et al.", "year": "2023", "url": "https://arxiv.org/abs/2302.12173v2" } ] }, { "id": "agent-trust-c20cb6ec", "claim": "AgentDojo scores runs in a stateful tool environment with formal checks of model output and environment state, rather than asking another language model whether an attack worked.", "evidence_type": "research", "kind": "reported", "section_url": "https://lugano.ai/research/agent-trust/#what-the-experiments-say", "sources": [ { "id": 9, "title": "AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents", "author": "Edoardo Debenedetti et al.", "year": "2024", "url": "https://proceedings.neurips.cc/paper_files/paper/2024/file/97091a5177d8dc64b1da8bf3e1f6fb54-Paper-Datasets_and_Benchmarks_Track.pdf" } ] }, { "id": "agent-trust-d9d0ae4d", "claim": "CaMeL’s 24 June 2025 arXiv v2 extracts control and data flow from the trusted query and enforces capabilities at tool calls, reporting a utility cost on AgentDojo under its stated security property; its main threat model trusts the user prompt and assumes uncompromised memory.", "evidence_type": "research", "kind": "reported", "section_url": "https://lugano.ai/research/agent-trust/#what-the-experiments-say", "sources": [ { "id": 2, "title": "Defeating Prompt Injections by Design (arXiv v2, 24 June 2025)", "author": "Edoardo Debenedetti et al.", "year": "2025", "url": "https://arxiv.org/abs/2503.18813v2" } ] }, { "id": "agent-trust-f5f54887", "claim": "Bhagwatkar et al.’s arXiv v2 (23 March 2026) argues that the four public benchmarks it tested are easily saturated by flawed metrics, implementation bugs and weak attacks, and reports non-trivial Sanitizer attack success in a defense-aware Stage 3 cascade in AgentDojo’s Slack suite, with one appendix bypass against a GPT-4o-based Sanitizer; the result is setup-specific.", "evidence_type": "research", "kind": "reported-preprint", "section_url": "https://lugano.ai/research/agent-trust/#what-the-experiments-say", "sources": [ { "id": 10, "title": "Indirect Prompt Injections: Are Firewalls All You Need, or Stronger Benchmarks? (arXiv v2, 23 March 2026)", "author": "Rishika Bhagwatkar et al.", "year": "2026", "url": "https://arxiv.org/abs/2510.05244v2" } ] }, { "id": "agent-trust-8ef330ac", "claim": "RFC 9396 supports expressing fine-grained authorization details such as a named payment recipient and amount or a specific file operation, beyond coarse scopes.", "evidence_type": "official", "kind": "official-standard", "section_url": "https://lugano.ai/research/agent-trust/#authorization-is-composed", "sources": [ { "id": 12, "title": "RFC 9396: OAuth 2.0 Rich Authorization Requests", "author": "Torsten Lodderstedt, Justin Richer, Brian Campbell", "year": "2023", "url": "https://www.rfc-editor.org/rfc/rfc9396.html" } ] }, { "id": "agent-trust-07a0e80c", "claim": "The dated 2025-06-18 MCP authorization specification applies to HTTP transport and states that STDIO implementations should retrieve credentials from the environment instead of using that historical transport specification.", "evidence_type": "official", "kind": "official-specification", "section_url": "https://lugano.ai/research/agent-trust/#authorization-is-composed", "sources": [ { "id": 3, "title": "Authorization — Model Context Protocol Specification (dated 2025-06-18)", "author": "Model Context Protocol project", "year": "2025", "url": "https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization" } ] }, { "id": "agent-trust-6deea076", "claim": "The MCP 2026-07-28 core specification states user-consent principles for data access and tool invocation, and says MCP itself cannot enforce those principles at the protocol level.", "evidence_type": "official", "kind": "official-specification", "section_url": "https://lugano.ai/research/agent-trust/#human-authorization-has-a-referent", "sources": [ { "id": 11, "title": "Model Context Protocol Core Specification (2026-07-28)", "author": "Model Context Protocol project", "year": "2026", "url": "https://modelcontextprotocol.io/specification/2026-07-28" } ] }, { "id": "agent-trust-d18080f5", "claim": "OAuth security guidance recommends audience-restricted and sender-constrained tokens while stating that compromise of both token and key material undermines sender constraint.", "evidence_type": "official", "kind": "official-guidance", "section_url": "https://lugano.ai/research/agent-trust/#the-enforcement-path", "sources": [ { "id": 4, "title": "RFC 9700: Best Current Practice for OAuth 2.0 Security", "author": "Torsten Lodderstedt, John Bradley, Alexander Labunets, Daniel Fett", "year": "2025", "url": "https://www.rfc-editor.org/rfc/rfc9700.html" } ] }, { "id": "agent-trust-eea7f4b8", "claim": "RFC 7009 notes that revocation can have a propagation delay among servers even when the authorization server invalidates a token.", "evidence_type": "official", "kind": "official-standard", "section_url": "https://lugano.ai/research/agent-trust/#the-enforcement-path", "sources": [ { "id": 5, "title": "RFC 7009: OAuth 2.0 Token Revocation", "author": "Torsten Lodderstedt, Stefanie Dronia, Marius Scurtescu", "year": "2013", "url": "https://www.rfc-editor.org/rfc/rfc7009.html" } ] }, { "id": "agent-trust-55fed110", "claim": "RATS architecture separates evidence appraisal from relying-party authorization and treats freshness as an architectural choice with a possible race after evidence is generated.", "evidence_type": "official", "kind": "official-architecture", "section_url": "https://lugano.ai/research/agent-trust/#evidence-and-privacy", "sources": [ { "id": 6, "title": "RFC 9334: Remote ATtestation procedureS (RATS) Architecture", "author": "Henk Birkholz et al.", "year": "2023", "url": "https://www.rfc-editor.org/rfc/rfc9334.html" } ] }, { "id": "agent-trust-7bc4940b", "claim": "Certificate Transparency inclusion and consistency mechanisms make logged statements auditable but do not by themselves guarantee monitoring or remediation.", "evidence_type": "official", "kind": "official-protocol", "section_url": "https://lugano.ai/research/agent-trust/#evidence-and-privacy", "sources": [ { "id": 7, "title": "RFC 9162: Certificate Transparency Version 2.0", "author": "Ben Laurie, Eran Messeri, Rob Stradling", "year": "2021", "url": "https://www.rfc-editor.org/rfc/rfc9162.html" } ] }, { "id": "agent-trust-a7c3196e", "claim": "Historical AAR v0.1 material: Lugano’s AAR v0.1 is an archived local draft. Bounded local checks record its offline checker rejecting valid inclusion paths and accepting a signed body missing most activity fields.", "evidence_type": "our-study", "kind": "local-evidence", "section_url": "https://lugano.ai/research/agent-trust/#evidence-and-privacy", "sources": [ { "id": 8, "title": "Attested Agent Receipt (AAR) v0.1", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/agent-trust/#source-8" }, { "id": 14, "title": "Receipt verifier — limited independent proof-path review (2 November 2026)", "author": "Local artifact review", "year": "2026", "url": "https://lugano.ai/research/agent-trust/#source-14" }, { "id": 15, "title": "Bounded local verifier artifact checks (2 November 2026)", "author": "Local artifact review", "year": "2026", "url": "https://lugano.ai/research/agent-trust/#source-15" } ] }, { "id": "agent-trust-2841c21f", "claim": "Historical AAR v0.1 material: The AAR draft says its listed metadata fields can disclose operational information and do not supply a privacy guarantee or establish zero retention.", "evidence_type": "our-study", "kind": "local-evidence", "section_url": "https://lugano.ai/research/agent-trust/#evidence-and-privacy", "sources": [ { "id": 8, "title": "Attested Agent Receipt (AAR) v0.1", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/agent-trust/#source-8" } ] }, { "id": "agent-trust-6a5be380", "claim": "NIST’s Generative AI Profile calls for defined and differentiated human-AI roles and responsibilities (GOVERN 3.2), evaluations proportional to identified risks (GV-3.2-001), and documentation of how content provenance data interacts with privacy and security (MS-2.2-002).", "evidence_type": "official", "kind": "official-guidance", "section_url": "https://lugano.ai/research/agent-trust/#human-authorization-has-a-referent", "sources": [ { "id": 13, "title": "Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile", "author": "National Institute of Standards and Technology", "year": "2024", "url": "https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf" } ] }, { "id": "agent-trust-6c1cce0f", "claim": "A deterministic mediator can enforce a specified authorization tuple without proving that the specification captured user intent, that source labels are correct, or that an approval was understood.", "evidence_type": "our-analysis", "kind": "analysis", "section_url": "https://lugano.ai/research/agent-trust/#authorization-is-composed", "sources": [ { "id": 11, "title": "Model Context Protocol Core Specification (2026-07-28)", "author": "Model Context Protocol project", "year": "2026", "url": "https://modelcontextprotocol.io/specification/2026-07-28" }, { "id": 12, "title": "RFC 9396: OAuth 2.0 Rich Authorization Requests", "author": "Torsten Lodderstedt, Justin Richer, Brian Campbell", "year": "2023", "url": "https://www.rfc-editor.org/rfc/rfc9396.html" } ] }, { "id": "agent-trust-beb0edca", "claim": "An integrity-protected receipt should be treated as evidence about the signed and logged assertion it contains, rather than proof of complete, fresh, semantically correct runtime truth.", "evidence_type": "our-analysis", "kind": "analysis", "section_url": "https://lugano.ai/research/agent-trust/#evidence-and-privacy", "sources": [ { "id": 6, "title": "RFC 9334: Remote ATtestation procedureS (RATS) Architecture", "author": "Henk Birkholz et al.", "year": "2023", "url": "https://www.rfc-editor.org/rfc/rfc9334.html" }, { "id": 7, "title": "RFC 9162: Certificate Transparency Version 2.0", "author": "Ben Laurie, Eran Messeri, Rob Stradling", "year": "2021", "url": "https://www.rfc-editor.org/rfc/rfc9162.html" }, { "id": 8, "title": "Attested Agent Receipt (AAR) v0.1", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/agent-trust/#source-8" } ] }, { "id": "agent-trust-994cd6fb", "claim": "Anthropic’s May 2026 engineering account distinguishes environmental, model and content controls and describes approval oversight as fallible; encoded approval binding does not establish attentive human review.", "evidence_type": "first-party", "kind": "vendor-engineering-account-and-analysis", "section_url": "https://lugano.ai/research/agent-trust/#the-remaining-question", "sources": [ { "id": 16, "title": "How we contain Claude across products", "author": "Anthropic Engineering", "year": "2026", "url": "https://www.anthropic.com/research/how-we-contain-claude" } ] }, { "id": "agent-trust-9af850ed", "claim": "NIST SP 800-160 Vol. 1 Rev. 1 lists defense in depth as a design principle: loss control should not rely on a single defensive element, and later lines of defense block escalation or contain loss.", "evidence_type": "official", "kind": "official-guidance", "section_url": "https://lugano.ai/research/agent-trust/#the-remaining-question", "sources": [ { "id": 17, "title": "NIST SP 800-160 Vol. 1 Rev. 1: Engineering Trustworthy Secure Systems", "author": "Ron Ross, Mark Winstead, Michael McEvilley", "year": "2022", "url": "https://doi.org/10.6028/NIST.SP.800-160v1r1" } ] } ] }, { "slug": "agentic-finance", "title": "Who controls agentic finance?", "url": "https://lugano.ai/research/agentic-finance/", "published": "2026-11-01", "revised": "2026-11-04", "in_short": "In AP2’s autonomous mode, the merchant and the credential provider check each checkout against limits the person approved, using fixed rules. Its pinned documentation doesn’t describe revoking those limits, so on our reading a short expiry does the work a revoke button would. If you put an agent in a checkout flow, name the party that holds the last no, and make sure it isn’t the agent.", "claims": [ { "id": "agentic-finance-6f065f60", "claim": "RAR can express structured payment authorization details such as amount, currency, creditor, account, action, and location rather than a coarse scope alone; it does not itself require a signed mandate.", "evidence_type": "official", "kind": "protocol specification", "section_url": "https://lugano.ai/research/agentic-finance/#control-moves-across-a-transaction", "sources": [ { "id": 1, "title": "RFC 9396: OAuth 2.0 Rich Authorization Requests", "author": "T. Lodderstedt, J. Richer, and B. Campbell; IETF", "year": "2023", "url": "https://www.rfc-editor.org/rfc/rfc9396.html" } ] }, { "id": "agentic-finance-79557432", "claim": "RAR field interpretation and allowable values are controlled by the authorization server and protected API definition.", "evidence_type": "official", "kind": "protocol limitation", "section_url": "https://lugano.ai/research/agentic-finance/#control-moves-across-a-transaction", "sources": [ { "id": 1, "title": "RFC 9396: OAuth 2.0 Rich Authorization Requests", "author": "T. Lodderstedt, J. Richer, and B. Campbell; IETF", "year": "2023", "url": "https://www.rfc-editor.org/rfc/rfc9396.html" } ] }, { "id": "agentic-finance-391fab18", "claim": "DPoP sender-constrains OAuth tokens and detects proof/token replay under its rules, but is not authentication or access control by itself and covers HTTP method and URI rather than the request body or general headers; it also does not guarantee once-only purchase execution.", "evidence_type": "official", "kind": "protocol specification", "section_url": "https://lugano.ai/research/agentic-finance/#a-mandate-must-survive-translation", "sources": [ { "id": 3, "title": "RFC 9449: OAuth 2.0 Demonstrating Proof of Possession (DPoP)", "author": "D. Fett and colleagues; IETF", "year": "2023", "url": "https://www.rfc-editor.org/rfc/rfc9449.html" } ] }, { "id": "agentic-finance-f2342e91", "claim": "OAuth security guidance recommends sender-constrained and audience-restricted access tokens to reduce misuse of stolen tokens.", "evidence_type": "official", "kind": "official guidance", "section_url": "https://lugano.ai/research/agentic-finance/#a-mandate-must-survive-translation", "sources": [ { "id": 4, "title": "RFC 9700: Best Current Practice for OAuth 2.0 Security", "author": "T. Lodderstedt, J. Bradley, A. Labunets, and D. Fett; IETF", "year": "2025", "url": "https://www.rfc-editor.org/rfc/rfc9700.html" } ] }, { "id": "agentic-finance-87bcb7a8", "claim": "FAPI 2.0 is a high-security OAuth profile for high-value APIs with formal analysis under a stated attacker model; its Note 2 says detailed analysis at publication covered authorization-code and CIBA flows. It requires resource-server checks for validity, integrity, expiration, revocation status, authorization sufficiency, and sender constraints; it does not prescribe a per-transition RFC 7662 call or zero-cache behavior.", "evidence_type": "official", "kind": "protocol specification", "section_url": "https://lugano.ai/research/agentic-finance/#a-mandate-must-survive-translation", "sources": [ { "id": 5, "title": "FAPI 2.0 Security Profile", "author": "D. Fett, D. Tonge, J. Heenan, and the OpenID Foundation FAPI Working Group", "year": "2025", "url": "https://openid.net/specs/fapi-security-profile-2_0.html" } ] }, { "id": "agentic-finance-ae2cbca5", "claim": "RFC 7009 specifies refresh-token revocation, recommends access-token revocation, and notes potential propagation delay and architecture-dependent behavior.", "evidence_type": "official", "kind": "protocol specification", "section_url": "https://lugano.ai/research/agentic-finance/#a-revoke-button-is-not-a-stop", "sources": [ { "id": 2, "title": "RFC 7009: OAuth 2.0 Token Revocation", "author": "T. Lodderstedt, S. Dronia, and M. Scurtescu; IETF", "year": "2013", "url": "https://www.rfc-editor.org/rfc/rfc7009.html" } ] }, { "id": "agentic-finance-fd9e23ac", "claim": "RFC 7662 defines token introspection and warns that caching status trades freshness for lower traffic and load, creating a window in which a revoked token is still used at a protected resource.", "evidence_type": "official", "kind": "protocol specification", "section_url": "https://lugano.ai/research/agentic-finance/#a-revoke-button-is-not-a-stop", "sources": [ { "id": 9, "title": "RFC 7662: OAuth 2.0 Token Introspection", "author": "J. Richer; IETF", "year": "2015", "url": "https://www.rfc-editor.org/rfc/rfc7662.html" } ] }, { "id": "agentic-finance-72d3ca36", "claim": "The pinned AP2 v0.2 specification assigns five roles, permits role co-location and delegated responsibilities, requires deterministic validation/processing, and distinguishes open autonomous consent from later closed checkout; agent-to-agent delegation and dispute operating details remain outside scope.", "evidence_type": "official", "kind": "protocol specification (v0.2)", "section_url": "https://lugano.ai/research/agentic-finance/#payment-protocols-draw-the-map", "sources": [ { "id": 6, "title": "Agentic Payment Protocol (AP2) v0.2, pinned source", "author": "Google Agentic Commerce", "year": "2026", "url": "https://github.com/google-agentic-commerce/AP2/blob/e1ea56db72a6385bce3e5c1112b3a56ce60acb43/docs/ap2/specification.md" } ] }, { "id": "agentic-finance-85ca8e9a", "claim": "For the autonomous flow, the pinned AP2 v0.2 specification recommends setting an open mandate’s exp to the smallest value that lets the shopping agent finish; its pinned documentation does not describe mandate revocation.", "evidence_type": "official", "kind": "protocol specification (v0.2)", "section_url": "https://lugano.ai/research/agentic-finance/#payment-protocols-draw-the-map", "sources": [ { "id": 6, "title": "Agentic Payment Protocol (AP2) v0.2, pinned source", "author": "Google Agentic Commerce", "year": "2026", "url": "https://github.com/google-agentic-commerce/AP2/blob/e1ea56db72a6385bce3e5c1112b3a56ce60acb43/docs/ap2/specification.md" } ] }, { "id": "agentic-finance-909139f8", "claim": "EMVCo’s 3DS overview describes merchant–issuer exchange of transaction, payment-method, and device data for issuer authentication. Its v2.0 White Paper (online edition, March 2025) describes frictionless authentication by real-time risk assessment and a challenge when that fails or risk is high, so a result alone does not prove fresh human approval of an agent’s cart.", "evidence_type": "official", "kind": "industry specification", "section_url": "https://lugano.ai/research/agentic-finance/#payment-protocols-draw-the-map", "sources": [ { "id": 7, "title": "EMV 3-D Secure", "author": "EMVCo", "year": "2026", "url": "https://www.emvco.com/emv-technologies/3-d-secure/" }, { "id": 10, "title": "EMV 3-D Secure White Paper v2.0, online edition", "author": "EMVCo", "year": "2025", "url": "https://www.emvco.com/dynamic/emv-3-d-secure-whitepaper-v2/" } ] }, { "id": "agentic-finance-2fc58fad", "claim": "Lugano’s historical AAR v0.1 is a proposed draft and its reference verifier does not observe a runtime or establish zero retention.", "evidence_type": "our-study", "kind": "local evidence", "section_url": "https://lugano.ai/research/agentic-finance/#a-receipt-needs-a-witness", "sources": [ { "id": 8, "title": "Attested Agent Receipt (AAR) v0.1", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/agentic-finance/#source-8" } ] } ] }, { "slug": "ai-defense", "title": "Can AI defend systems without becoming another way in?", "url": "https://lugano.ai/research/ai-defense/", "published": "2026-11-01", "revised": "2026-11-04", "in_short": "Planted log lines could make an AI defender block your own payment gateway, with a tool it’s allowed to use. By our untested reasoning, a tool allowlist would let that block through, and a strict data-flow rule would hold it, along with routine blocks whose targets came from alerts. We propose a rule outside the model that checks each target against the network sensor’s own record before the agent blocks it.", "claims": [ { "id": "ai-defense-609ee5b6", "claim": "DARPA reported that AIxCC competitors collectively discovered 54 unique synthetic vulnerabilities and patched 43 of them; DARPA’s corrected count puts 63 synthetic vulnerabilities in the final. This is an aggregate across systems.", "evidence_type": "research", "kind": "published controlled-evaluation result", "section_url": "https://lugano.ai/research/ai-defense/#related-work", "sources": [ { "id": 5, "title": "AI Cyber Challenge marks pivotal inflection point for cyber defense", "author": "Defense Advanced Research Projects Agency", "year": "2025", "url": "https://www.darpa.mil/news/2025/aixcc-results" } ] }, { "id": "ai-defense-b336edc8", "claim": "DARPA reported that AIxCC competitors found 18 real, non-synthetic vulnerabilities during the event, with responsible disclosure to maintainers underway.", "evidence_type": "research", "kind": "published controlled-evaluation result", "section_url": "https://lugano.ai/research/ai-defense/#related-work", "sources": [ { "id": 5, "title": "AI Cyber Challenge marks pivotal inflection point for cyber defense", "author": "Defense Advanced Research Projects Agency", "year": "2025", "url": "https://www.darpa.mil/news/2025/aixcc-results" } ] }, { "id": "ai-defense-b6c0024e", "claim": "BIPIA reports that the models it evaluated were vulnerable to its indirect-prompt-injection benchmark and identifies difficulty distinguishing data from instructions as a contributing factor.", "evidence_type": "research", "kind": "published benchmark finding", "section_url": "https://lugano.ai/research/ai-defense/#work-it-stops", "sources": [ { "id": 2, "title": "Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models", "author": "Jingwei Yi et al.", "year": "2023", "url": "https://arxiv.org/abs/2312.14197" } ] }, { "id": "ai-defense-2c6ee230", "claim": "In AgentDojo Table 5’s GPT-4o comparison against the strongest evaluated attack, the prompt-injection detector reduced targeted ASR from 57.69% to 7.95% while benign utility fell from 69.00% to 41.49%; these are paired condition-specific results.", "evidence_type": "research", "kind": "published benchmark result", "section_url": "https://lugano.ai/research/ai-defense/#work-it-stops", "sources": [ { "id": 3, "title": "AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents", "author": "Edoardo Debenedetti et al.", "year": "2024", "url": "https://proceedings.neurips.cc/paper_files/paper/2024/file/97091a5177d8dc64b1da8bf3e1f6fb54-Paper-Datasets_and_Benchmarks_Track.pdf" } ] }, { "id": "ai-defense-64841e26", "claim": "CyberSecEval 2 evaluates false refusal for cyberattack helpfulness in a test separate from its prompt-injection tests, framing it as a safety-utility trade-off.", "evidence_type": "research", "kind": "published benchmark result", "section_url": "https://lugano.ai/research/ai-defense/#related-work", "sources": [ { "id": 6, "title": "CyberSecEval 2: A Wide-Ranging Cybersecurity Evaluation Suite for Large Language Models", "author": "Manish Bhatt et al.", "year": "2024", "url": "https://arxiv.org/abs/2404.13161" } ] }, { "id": "ai-defense-d11590e9", "claim": "NIST AI 100-2e2023 organizes adversarial-machine-learning terminology by attacker goals, capabilities, lifecycle stages, and mitigation concepts.", "evidence_type": "official", "kind": "official taxonomy", "section_url": "https://lugano.ai/research/ai-defense/#related-work", "sources": [ { "id": 1, "title": "Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (NIST AI 100-2e2023)", "author": "Apostol Vassilev, Alina Oprea, Alie Fordyce, and Hyrum Anderson", "year": "2024", "url": "https://www.nist.gov/publications/adversarial-machine-learning-taxonomy-and-terminology-attacks-and-mitigations" } ] }, { "id": "ai-defense-26a9b6c4", "claim": "NVD records that fail2ban 0.8 and earlier did not properly parse sshd logs, letting remote attackers add arbitrary hosts to /etc/hosts.deny and cause a denial of service through an IP address string in the SSH client version identification.", "evidence_type": "official", "kind": "official vulnerability record", "section_url": "https://lugano.ai/research/ai-defense/#planted-target", "sources": [ { "id": 7, "title": "CVE-2007-4321 Detail", "author": "National Institute of Standards and Technology, National Vulnerability Database", "year": "2007", "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-4321" } ] }, { "id": "ai-defense-4bcde29e", "claim": "A 2007 write-up demonstrated remote log injection against DenyHosts and BlockHosts (and reported fail2ban vulnerable), including an injection that made DenyHosts block “all”; in its sshd protocol-mismatch examples the daemon logged the real client address at the end of the line while DenyHosts matched planted text.", "evidence_type": "research", "kind": "published vulnerability demonstration", "section_url": "https://lugano.ai/research/ai-defense/#planted-target", "sources": [ { "id": 8, "title": "Log injection - Attacking Log Analysis Tools", "author": "Daniel B. Cid", "year": "2007", "url": "https://dcid.me/texts/attacking-log-analysis-tools.html" } ] }, { "id": "ai-defense-6b7ace2a", "claim": "The 2007 write-up proposed fixing one DenyHosts pattern by anchoring it to the end of the log line; whether an equivalent anchor exists for free-form alerts is Lugano’s open design question.", "evidence_type": "our-analysis", "kind": "published fix proposal and Lugano interpretation", "section_url": "https://lugano.ai/research/ai-defense/#sensor-check", "sources": [ { "id": 8, "title": "Log injection - Attacking Log Analysis Tools", "author": "Daniel B. Cid", "year": "2007", "url": "https://dcid.me/texts/attacking-log-analysis-tools.html" } ] }, { "id": "ai-defense-4cb7d984", "claim": "AgentDojo’s authors attribute the tool filter’s effectiveness partly to cases that pair a read-only user task with a write-requiring attacker goal, and state that it fails when the task’s tools suffice for the attack, as in 17% of their test cases, or when the tools cannot be planned in advance.", "evidence_type": "research", "kind": "published benchmark analysis", "section_url": "https://lugano.ai/research/ai-defense/#usual-guards", "sources": [ { "id": 3, "title": "AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents", "author": "Edoardo Debenedetti et al.", "year": "2024", "url": "https://proceedings.neurips.cc/paper_files/paper/2024/file/97091a5177d8dc64b1da8bf3e1f6fb54-Paper-Datasets_and_Benchmarks_Track.pdf" } ] }, { "id": "ai-defense-1c2f9b66", "claim": "Working hypothesis, not measured: in defensive response, the write tool a task needs usually suffices for the attack, so the overlap AgentDojo reports for 17% of its cases would be common.", "evidence_type": "our-analysis", "kind": "working hypothesis", "section_url": "https://lugano.ai/research/ai-defense/#usual-guards", "sources": [] }, { "id": "ai-defense-2340b570", "claim": "In CaMeL’s worked example, sending a confidential document to an address read from untrusted meeting notes requires user approval, even with no adversary present, when that recipient lacks read access.", "evidence_type": "research", "kind": "published design description", "section_url": "https://lugano.ai/research/ai-defense/#usual-guards", "sources": [ { "id": 4, "title": "Defeating Prompt Injections by Design", "author": "Edoardo Debenedetti et al.", "year": "2025", "url": "https://arxiv.org/abs/2503.18813" } ] }, { "id": "ai-defense-b4ee4c50", "claim": "Progent expresses privilege policies over tool names and arguments and states that it cannot defend against attacks that operate within least privilege.", "evidence_type": "research", "kind": "published design and scope statement", "section_url": "https://lugano.ai/research/ai-defense/#more-designs", "sources": [ { "id": 9, "title": "Progent: Securing AI Agents with Privilege Control (arXiv v3, 14 May 2026)", "author": "Tianneng Shi, Jingxuan He, Zhun Wang, Hongwei Li, Linyu Wu, Wenbo Guo, and Dawn Song", "year": "2026", "url": "https://arxiv.org/abs/2504.11703v3" } ] }, { "id": "ai-defense-10ebaf3b", "claim": "PACT assigns roles to tool arguments, lets external data fill content roles, and blocks it from authority-bearing target roles unless a registered discharge procedure covers the failed check.", "evidence_type": "research", "kind": "published design description", "section_url": "https://lugano.ai/research/ai-defense/#more-designs", "sources": [ { "id": 10, "title": "The Granularity Mismatch in Agent Security: Argument-Level Provenance Solves Enforcement and Isolates the LLM Reasoning Bottleneck (arXiv v1)", "author": "Linfeng Fan, Ziwei Li, Yuan Tian, Yichen Wang, Rongsheng Li, and Xiong Wang", "year": "2026", "url": "https://arxiv.org/abs/2605.11039v1" } ] }, { "id": "ai-defense-6a8871d3", "claim": "The reviewed study of adversarial log content against LLM-augmented security operations does not assume its model can execute commands or call tools; it scores labels, summaries, and remediation advice.", "evidence_type": "research", "kind": "published research scope", "section_url": "https://lugano.ai/research/ai-defense/#work-it-stops", "sources": [ { "id": 11, "title": "Poisoning the Watchtower: Prompt Injection Attacks Against LLM-Augmented Security Operations Through Adversarial Log Content (arXiv v1)", "author": "Rohan Pandey and Archit Bhujang", "year": "2026", "url": "https://arxiv.org/abs/2605.24421v1" } ] }, { "id": "ai-defense-6b8f68cb", "claim": "Lugano interpretation: the sources reviewed here do not measure how often planted evidence selects the target of a permitted defensive action, or how often a stricter rule refuses a correct but unusual target.", "evidence_type": "our-analysis", "kind": "interpretation of reviewed sources", "section_url": "https://lugano.ai/research/ai-defense/#work-it-stops", "sources": [ { "id": 3, "title": "AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents", "author": "Edoardo Debenedetti et al.", "year": "2024", "url": "https://proceedings.neurips.cc/paper_files/paper/2024/file/97091a5177d8dc64b1da8bf3e1f6fb54-Paper-Datasets_and_Benchmarks_Track.pdf" }, { "id": 4, "title": "Defeating Prompt Injections by Design", "author": "Edoardo Debenedetti et al.", "year": "2025", "url": "https://arxiv.org/abs/2503.18813" }, { "id": 9, "title": "Progent: Securing AI Agents with Privilege Control (arXiv v3, 14 May 2026)", "author": "Tianneng Shi, Jingxuan He, Zhun Wang, Hongwei Li, Linyu Wu, Wenbo Guo, and Dawn Song", "year": "2026", "url": "https://arxiv.org/abs/2504.11703v3" }, { "id": 10, "title": "The Granularity Mismatch in Agent Security: Argument-Level Provenance Solves Enforcement and Isolates the LLM Reasoning Bottleneck (arXiv v1)", "author": "Linfeng Fan, Ziwei Li, Yuan Tian, Yichen Wang, Rongsheng Li, and Xiong Wang", "year": "2026", "url": "https://arxiv.org/abs/2605.11039v1" }, { "id": 11, "title": "Poisoning the Watchtower: Prompt Injection Attacks Against LLM-Augmented Security Operations Through Adversarial Log Content (arXiv v1)", "author": "Rohan Pandey and Archit Bhujang", "year": "2026", "url": "https://arxiv.org/abs/2605.24421v1" } ] } ] }, { "slug": "attested-agent-receipt", "title": "What should an agent receipt be able to prove?", "url": "https://lugano.ai/research/attested-agent-receipt/", "published": "2026-11-02", "revised": "2026-11-04", "in_short": "A v0.2 pass prints ARTIFACT CHECKS PASSED, never VERIFIED, and means only that keys you chose signed these bytes in a fixed format and logged them under one root. Whether the agent did what the receipt says needs a named observer, which no format supplies by itself. Before you trust any agent receipt, ask which key signed it, whether you chose that key, and who watched the events.", "claims": [ { "id": "attested-agent-receipt-493a4441", "claim": "Historical AAR v0.1 material: The local AAR v0.1 is a proposed draft with an illustrative example, not a real run or deployed service.", "evidence_type": "our-design", "kind": "local-draft", "section_url": "https://lugano.ai/research/attested-agent-receipt/#what-the-record-says", "sources": [ { "id": 1, "title": "Historical v0.1 — Attested Agent Receipt (AAR) v0.1", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/attested-agent-receipt/#source-1" } ] }, { "id": "attested-agent-receipt-c91c4206", "claim": "Historical AAR v0.1 material: The proposed receipt includes claimed runtime, policy, tool, ledger, retention, log and signature fields; its retained field is a statement rather than an independent deletion measurement.", "evidence_type": "our-design", "kind": "local-draft", "section_url": "https://lugano.ai/research/attested-agent-receipt/#what-the-record-says", "sources": [ { "id": 1, "title": "Historical v0.1 — Attested Agent Receipt (AAR) v0.1", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/attested-agent-receipt/#source-1" } ] }, { "id": "attested-agent-receipt-c2803ef9", "claim": "RFC 9162 specifies certificate transparency artifacts including signed tree heads and Merkle inclusion and consistency proofs.", "evidence_type": "official", "kind": "official-protocol", "section_url": "https://lugano.ai/research/attested-agent-receipt/#the-log-boundary", "sources": [ { "id": 4, "title": "RFC 9162: Certificate Transparency Version 2.0", "author": "Ben Laurie, Eran Messeri and Rob Stradling", "year": "2021", "url": "https://www.rfc-editor.org/rfc/rfc9162.html" } ] }, { "id": "attested-agent-receipt-47f78ab0", "claim": "Historical AAR v0.1 material: The prototype skips vendor or manufacturer attestation-root verification and does not authenticate a runtime by that route.", "evidence_type": "our-design", "kind": "local-prototype", "section_url": "https://lugano.ai/research/attested-agent-receipt/#attestation-and-observation", "sources": [ { "id": 1, "title": "Historical v0.1 — Attested Agent Receipt (AAR) v0.1", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/attested-agent-receipt/#source-1" }, { "id": 2, "title": "Historical v0.1 — AAR reference verifier", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/attested-agent-receipt/#source-2" } ] }, { "id": "attested-agent-receipt-f0b97aac", "claim": "RFC 9334 distinguishes attesters, verifiers, relying parties and appraisal, with freshness and trust as architectural considerations.", "evidence_type": "official", "kind": "official-architecture", "section_url": "https://lugano.ai/research/attested-agent-receipt/#attestation-and-observation", "sources": [ { "id": 5, "title": "RFC 9334: Remote ATtestation procedureS (RATS) Architecture", "author": "Henk Birkholz et al.", "year": "2023", "url": "https://www.rfc-editor.org/rfc/rfc9334.html" } ] }, { "id": "attested-agent-receipt-16237e4e", "claim": "Historical AAR v0.1 material: The draft omits prompts and file contents from its listed fields but includes metadata that can reveal operational information; the retained check compares a supplied value rather than observing deletion.", "evidence_type": "our-design", "kind": "local-draft", "section_url": "https://lugano.ai/research/attested-agent-receipt/#what-the-record-says", "sources": [ { "id": 1, "title": "Historical v0.1 — Attested Agent Receipt (AAR) v0.1", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/attested-agent-receipt/#source-1" }, { "id": 2, "title": "Historical v0.1 — AAR reference verifier", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/attested-agent-receipt/#source-2" } ] }, { "id": "attested-agent-receipt-46757c64", "claim": "Historical AAR v0.1 material: In a synthetic eight-leaf tree, the historical v0.1 inclusion routine produced a root different from the independently constructed root for valid paths at four tested indexes; the check does not establish a general failure rate or invalid-proof acceptance.", "evidence_type": "our-study", "kind": "local-synthetic-check", "section_url": "https://lugano.ai/research/attested-agent-receipt/#the-question", "sources": [ { "id": 2, "title": "Historical v0.1 — AAR reference verifier", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/attested-agent-receipt/#source-2" }, { "id": 6, "title": "Receipt verifier proof check", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/attested-agent-receipt/#source-6" }, { "id": 9, "title": "Synthetic verifier-check result transcript", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/attested-agent-receipt/#source-9" } ] }, { "id": "attested-agent-receipt-2543ceaf", "claim": "AAR proposes receipt fields using established cryptographic mechanisms; the proposed richer-versus-minimized comparison does not test its value over a same-field conventional export.", "evidence_type": "our-design", "kind": "research-position", "section_url": "https://lugano.ai/research/attested-agent-receipt/#the-question", "sources": [ { "id": 1, "title": "Historical v0.1 — Attested Agent Receipt (AAR) v0.1", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/attested-agent-receipt/#source-1" }, { "id": 3, "title": "RFC 8785: JSON Canonicalization Scheme (JCS)", "author": "Anders Rundgren, Bret Jordan and Samuel Erdtman", "year": "2020", "url": "https://www.rfc-editor.org/rfc/rfc8785.html" }, { "id": 4, "title": "RFC 9162: Certificate Transparency Version 2.0", "author": "Ben Laurie, Eran Messeri and Rob Stradling", "year": "2021", "url": "https://www.rfc-editor.org/rfc/rfc9162.html" }, { "id": 5, "title": "RFC 9334: Remote ATtestation procedureS (RATS) Architecture", "author": "Henk Birkholz et al.", "year": "2023", "url": "https://www.rfc-editor.org/rfc/rfc9334.html" }, { "id": 7, "title": "in-toto: Providing farm-to-table guarantees for bits and bytes", "author": "Torres-Arias et al.", "year": "2019", "url": "https://www.usenix.org/system/files/sec19-torres-arias.pdf" } ] }, { "id": "attested-agent-receipt-5b3fa421", "claim": "Historical AAR v0.1 material: In a bounded synthetic check, the verifier returned VERIFIED for a signed one-leaf body omitting the run, measurement, policy, attestation and ledger fields described in the draft.", "evidence_type": "our-study", "kind": "local-synthetic-check", "section_url": "https://lugano.ai/research/attested-agent-receipt/#the-question", "sources": [ { "id": 2, "title": "Historical v0.1 — AAR reference verifier", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/attested-agent-receipt/#source-2" }, { "id": 8, "title": "Internal synthetic verifier artifact checks, 2 November 2026", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/attested-agent-receipt/#source-8" }, { "id": 9, "title": "Synthetic verifier-check result transcript", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/attested-agent-receipt/#source-9" } ] }, { "id": "attested-agent-receipt-36c590e1", "claim": "Signed Agent Receipt v0.2 is a bounded offline implementation with a fixed input schema, externally selected issuer and log keys, domain-separated Ed25519 signing bytes, and Merkle membership checks. A pass establishes only that the statement matches the schema, that the selected issuer and log keys signed the statement and tree head, and that the statement is a member of that signed root; it does not establish event truth, completeness, hardware attestation, retention, time, or public-log history. Inventory lists may be empty.", "evidence_type": "our-design", "kind": "local-reference-implementation", "section_url": "https://lugano.ai/research/attested-agent-receipt/#version-02", "sources": [ { "id": 10, "title": "Signed Agent Receipt Reference Profile v0.2", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/attested-agent-receipt/#source-10" }, { "id": 11, "title": "Signed Agent Receipt v0.2: README and checker guide", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/attested-agent-receipt/#source-11" } ] }, { "id": "attested-agent-receipt-5ca14b2f", "claim": "According to its README and internal review record, the v0.2 bundle contains executable tests and deterministic synthetic fixtures, and a separately authored internal adversarial review records exact inputs, hashes, results, findings and rechecks. The source code, tests and fixtures are on GitHub, at Lugano-AI/signed-agent-receipt. This is agent-assisted internal review, not external certification or a real-run privacy study.", "evidence_type": "our-study", "kind": "internal-conformance-review", "section_url": "https://lugano.ai/research/attested-agent-receipt/#version-02", "sources": [ { "id": 11, "title": "Signed Agent Receipt v0.2: README and checker guide", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/attested-agent-receipt/#source-11" }, { "id": 12, "title": "Signed Agent Receipt v0.2: internal review record", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/attested-agent-receipt/#source-12" } ] } ] }, { "slug": "breach-analysis", "title": "What actually failed in a breach?", "url": "https://lugano.ai/research/breach-analysis/", "published": "2026-11-01", "revised": "2026-11-04", "in_short": "In three 2023 incidents at Microsoft, Okta and Cloudflare, what failed was a credential that still worked when its owner didn’t expect it to. Multi-factor login matters at the front door, while a forged token, a saved password and an account believed unused all come after it. If a supplier tells you it was breached, check this week which credentials it could have exposed still work.", "claims": [ { "id": "breach-analysis-08b115e9", "claim": "The CSRB reported that Storm-0558 compromised mailboxes at 22 organizations and more than 500 individuals using tokens signed with a Microsoft-created 2016 key artifact; the review retained the key’s acquisition as unresolved.", "evidence_type": "research", "kind": "independent incident-review finding", "section_url": "https://lugano.ai/research/breach-analysis/#storm-0558-known-path-unknown-origin", "sources": [ { "id": 1, "title": "Review of the Summer 2023 Microsoft Exchange Online Intrusion", "author": "U.S. Cyber Safety Review Board", "year": "2024", "url": "https://www.cisa.gov/sites/default/files/2024-03/CSRB%20Review%20of%20the%20Summer%202023%20MEO%20Intrusion%20Final_508c.pdf" } ] }, { "id": "breach-analysis-dae3683b", "claim": "Microsoft’s July 2023 technical account described approximately 25 affected organizations and reported that forged tokens using an acquired consumer signing key were accepted because of a validation issue.", "evidence_type": "first-party", "kind": "first-party incident disclosure", "section_url": "https://lugano.ai/research/breach-analysis/#storm-0558-known-path-unknown-origin", "sources": [ { "id": 2, "title": "Analysis of Storm-0558 techniques for unauthorized email access", "author": "Microsoft Threat Intelligence", "year": "2023", "url": "https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/" } ] }, { "id": "breach-analysis-3ae7cba2", "claim": "Okta reported unauthorized support-system access from September 28 through October 17, 2023, to files associated with 134 customers, and said session tokens in some HAR files were used to hijack the legitimate Okta sessions of five customers.", "evidence_type": "first-party", "kind": "first-party incident disclosure", "section_url": "https://lugano.ai/research/breach-analysis/#okta-when-the-scope-moves", "sources": [ { "id": 4, "title": "Unauthorized Access to Okta’s Support Case Management System: Root Cause and Remediation", "author": "David Bradbury, Okta Security", "year": "2023", "url": "https://sec.okta.com/articles/2023/11/unauthorized-access-oktas-support-case-management-system-root-cause/" } ] }, { "id": "breach-analysis-e7b36c3a", "claim": "Okta’s November 29 update reported a downloaded support-user report with a broader stated customer scope than the 134-customer accessed-file count in its earlier report; it said 99.6% of users had only full name and email address as contact information.", "evidence_type": "first-party", "kind": "first-party incident-update disclosure", "section_url": "https://lugano.ai/research/breach-analysis/#okta-when-the-scope-moves", "sources": [ { "id": 4, "title": "Unauthorized Access to Okta’s Support Case Management System: Root Cause and Remediation", "author": "David Bradbury, Okta Security", "year": "2023", "url": "https://sec.okta.com/articles/2023/11/unauthorized-access-oktas-support-case-management-system-root-cause/" }, { "id": 5, "title": "October Customer Support Security Incident - Update and Recommended Actions", "author": "David Bradbury, Okta Security", "year": "2023", "url": "https://sec.okta.com/articles/october-security-incident-recommended-actions/" } ] }, { "id": "breach-analysis-b795cf48", "claim": "Cloudflare reported use of one access token and three unrotated service-account credentials after the Okta compromise, including Atlassian-related access and a separate segmented AWS environment, and said actor access ended on November 24.", "evidence_type": "first-party", "kind": "first-party incident disclosure", "section_url": "https://lugano.ai/research/breach-analysis/#cloudflare-the-trust-inventory", "sources": [ { "id": 6, "title": "Thanksgiving 2023 security incident", "author": "Matthew Prince, John Graham-Cumming, and Grant Bourzikas, Cloudflare", "year": "2024", "url": "https://blog.cloudflare.com/thanksgiving-2023-security-incident/" } ] }, { "id": "breach-analysis-515ffa99", "claim": "Cloudflare reported rotating more than 5,000 production credentials and conducting forensic triage on 4,893 systems after the incident.", "evidence_type": "first-party", "kind": "first-party incident disclosure", "section_url": "https://lugano.ai/research/breach-analysis/#cloudflare-the-trust-inventory", "sources": [ { "id": 6, "title": "Thanksgiving 2023 security incident", "author": "Matthew Prince, John Graham-Cumming, and Grant Bourzikas, Cloudflare", "year": "2024", "url": "https://blog.cloudflare.com/thanksgiving-2023-security-incident/" } ] }, { "id": "breach-analysis-5fdf9fdf", "claim": "Mandiant reported SaaS-permission abuse and help-desk social engineering in its own UNC3944 investigations; that context is not attribution evidence for the three case studies.", "evidence_type": "research", "kind": "broader incident-response observation", "section_url": "https://lugano.ai/research/breach-analysis/#compare-the-decision-boundaries", "sources": [ { "id": 7, "title": "UNC3944 Targets SaaS Applications", "author": "Mandiant Intelligence", "year": "2024", "url": "https://cloud.google.com/blog/topics/threat-intelligence/unc3944-targets-saas-applications" } ] }, { "id": "breach-analysis-2cf2b3ef", "claim": "Okta’s October 2023 notice said an unauthorized actor had accessed files in its support case-management system and warned that HAR files can contain session tokens; later updates refined the documented scope and mechanism.", "evidence_type": "first-party", "kind": "first-party initial incident disclosure", "section_url": "https://lugano.ai/research/breach-analysis/#okta-when-the-scope-moves", "sources": [ { "id": 3, "title": "Tracking Unauthorized Access to Okta’s Support System", "author": "David Bradbury, Okta Security", "year": "2023", "url": "https://sec.okta.com/articles/2023/10/tracking-unauthorized-access-oktas-support-system/" } ] }, { "id": "breach-analysis-1ea98fdd", "claim": "NIST SP 800-207 describes zero trust as resource-focused protection with explicit authentication and authorization; it is architecture guidance, not evidence that a particular identity compromise would have been prevented.", "evidence_type": "official", "kind": "official architecture guidance", "section_url": "https://lugano.ai/research/breach-analysis/#compare-the-decision-boundaries", "sources": [ { "id": 8, "title": "Zero Trust Architecture (NIST SP 800-207)", "author": "Scott Rose, Oliver Borchert, Stu Mitchell, and Sean Connelly", "year": "2020", "url": "https://www.nist.gov/publications/zero-trust-architecture-0" } ] }, { "id": "breach-analysis-ca54171c", "claim": "The CSRB determined that Microsoft had no evidence or logs showing the 2016 key in or exfiltrated from a crash dump, and criticized Microsoft’s delayed public correction of its key-acquisition account.", "evidence_type": "research", "kind": "independent incident-review finding", "section_url": "https://lugano.ai/research/breach-analysis/#storm-0558-known-path-unknown-origin", "sources": [ { "id": 1, "title": "Review of the Summer 2023 Microsoft Exchange Online Intrusion", "author": "U.S. Cyber Safety Review Board", "year": "2024", "url": "https://www.cisa.gov/sites/default/files/2024-03/CSRB%20Review%20of%20the%20Summer%202023%20MEO%20Intrusion%20Final_508c.pdf" } ] } ] }, { "slug": "cheap-inference", "title": "When thinking is cheap, what is your data worth?", "url": "https://lugano.ai/research/cheap-inference/", "published": "2026-11-03", "revised": "2026-11-04", "in_short": "Capability spreads, and Anthropic says three labs ran over 16 million exchanges with Claude to copy its abilities. Records about particular people spread far less readily, so they last, and anyone who gets hold of them can sort them for almost nothing. For most firms that makes them a liability first, so keep less and clean what has to leave your machine.", "claims": [ { "id": "cheap-inference-53c1c483", "claim": "Cointelegraph’s 3 November 2026 clip from Devcon 8 quotes Vitalik Buterin saying data should be treated as toxic waste by default, and says he called for open-source technology and zero-knowledge proofs to reduce reliance on trust.", "evidence_type": "reporting", "kind": "news report of a public statement", "section_url": "https://lugano.ai/research/cheap-inference/#toxic-waste", "sources": [ { "id": 1, "title": "Vitalik: “We really need to treat data as toxic waste by default” (Devcon 8 clip)", "author": "Cointelegraph", "year": "2026", "url": "https://x.com/Cointelegraph/status/2117529066668765284" } ] }, { "id": "cheap-inference-c4fc59aa", "claim": "David Hoffman wrote on 3 November 2026 that as AI inference becomes increasingly free, personal data becomes more useful, and that reducing one’s data footprint will become a normal practice.", "evidence_type": "research", "kind": "published opinion", "section_url": "https://lugano.ai/research/cheap-inference/#toxic-waste", "sources": [ { "id": 2, "title": "Post sharing Cointelegraph’s Devcon 8 clip", "author": "David Hoffman (@TrustlessState)", "year": "2026", "url": "https://x.com/trustlessstate/status/2117618705580569047" } ] }, { "id": "cheap-inference-54a49127", "claim": "Epoch AI estimates that the cost of reaching a fixed benchmark score with the cheapest available model has fallen about 47% per quarter, or about 13x per year, since 2023.", "evidence_type": "research", "kind": "independent-measurement", "section_url": "https://lugano.ai/research/cheap-inference/#the-price-of-thought", "sources": [ { "id": 3, "title": "The plunging price of thought", "author": "Luke Emberson, David Roodman (Epoch AI)", "year": "2026", "url": "https://epoch.ai/publications/the-plunging-price-of-thought" } ] }, { "id": "cheap-inference-5ec3fd13", "claim": "Epoch AI's 2025 per-token analysis found LLM inference price declines of 9x to 900x per year depending on the task, with a median of 50x.", "evidence_type": "research", "kind": "independent-measurement", "section_url": "https://lugano.ai/research/cheap-inference/#the-price-of-thought", "sources": [ { "id": 5, "title": "LLM inference prices have fallen rapidly but unequally across tasks", "author": "Ben Cottier, Ben Snodin, David Owen, Tom Adamczewski (Epoch AI)", "year": "2025", "url": "https://epoch.ai/data-insights/llm-inference-price-trends" } ] }, { "id": "cheap-inference-acf9fbaf", "claim": "Staab et al. report that GPT-4 inferred personal attributes from Reddit comments with up to 85% top-1 and 95% top-3 accuracy, at about 100x lower cost and 240x less time than human labelers.", "evidence_type": "research", "kind": "peer-reviewed-research", "section_url": "https://lugano.ai/research/cheap-inference/#the-price-of-thought", "sources": [ { "id": 7, "title": "Beyond Memorization: Violating Privacy Via Inference with Large Language Models", "author": "Robin Staab, Mark Vero, Mislav Balunović, Martin Vechev", "year": "2024", "url": "https://arxiv.org/abs/2310.07298" } ] }, { "id": "cheap-inference-44dc2792", "claim": "Lermen et al. report that a web-search agent identified 67% of 338 Hacker News users from anonymized activity summaries at 90% precision, at $1 to $4 per profile, and that in a separate matching test an LLM pipeline reached up to 68% recall at 90% precision; the identities were known to the researchers.", "evidence_type": "research", "kind": "independent-research", "section_url": "https://lugano.ai/research/cheap-inference/#the-price-of-thought", "sources": [ { "id": 4, "title": "Large-scale online deanonymization with LLMs", "author": "Simon Lermen, Daniel Paleka, Joshua Swanson, Michael Aerni, Nicholas Carlini, Florian Tramèr", "year": "2026", "url": "https://arxiv.org/abs/2602.16800" } ] }, { "id": "cheap-inference-ae576631", "claim": "Anthropic reported that three labs ran over 16 million exchanges with Claude through about 24,000 fraudulent accounts to distill its capabilities.", "evidence_type": "first-party", "kind": "first-party-disclosure", "section_url": "https://lugano.ai/research/cheap-inference/#our-view", "sources": [ { "id": 14, "title": "Detecting and preventing distillation attacks", "author": "Anthropic", "year": "2026", "url": "https://www.anthropic.com/news/detecting-and-preventing-distillation-attacks" } ] }, { "id": "cheap-inference-4fb1b351", "claim": "On 13 May 2025 Magistrate Judge Wang ordered OpenAI to preserve and segregate all output log data that would otherwise be deleted, including data users asked to delete.", "evidence_type": "official", "kind": "court-record", "section_url": "https://lugano.ai/research/cheap-inference/#the-court-got-there-first", "sources": [ { "id": 18, "title": "Order directing OpenAI to preserve and segregate output log data (ECF 551, No. 1:23-cv-11195)", "author": "U.S. District Court, S.D.N.Y. (Magistrate Judge Ona T. Wang)", "year": "2025", "url": "https://storage.courtlistener.com/recap/gov.uscourts.nysd.612697/gov.uscourts.nysd.612697.551.0.pdf" } ] }, { "id": "cheap-inference-64b2ab72", "claim": "OpenAI's ongoing preservation duty ended as of 26 September 2025, with already-segregated data preserved except for users in the EEA, Switzerland and the UK.", "evidence_type": "official", "kind": "court-record", "section_url": "https://lugano.ai/research/cheap-inference/#the-court-got-there-first", "sources": [ { "id": 19, "title": "Stipulation and Order to terminate OpenAI's ongoing obligations under the preservation order (ECF 922)", "author": "U.S. District Court, S.D.N.Y.", "year": "2025", "url": "https://storage.courtlistener.com/recap/gov.uscourts.nysd.612697/gov.uscourts.nysd.612697.922.0.pdf" } ] }, { "id": "cheap-inference-d766fa19", "claim": "On 5 January 2026 Judge Stein affirmed orders requiring OpenAI to produce 20 million de-identified consumer ChatGPT logs, reasoning that the privacy interest in chats voluntarily disclosed to and retained by OpenAI is weaker than in wiretapped calls.", "evidence_type": "official", "kind": "court-record", "section_url": "https://lugano.ai/research/cheap-inference/#the-court-got-there-first", "sources": [ { "id": 20, "title": "Order granting motion to compel production of 20 million de-identified consumer ChatGPT logs (MDL ECF 734, No. 1:25-md-3143)", "author": "U.S. District Court, S.D.N.Y. (Magistrate Judge Ona T. Wang)", "year": "2025", "url": "https://storage.courtlistener.com/recap/gov.uscourts.nysd.640396/gov.uscourts.nysd.640396.734.0.pdf" }, { "id": 21, "title": "Order affirming the 20-million-log production orders (MDL ECF 1021)", "author": "U.S. District Court, S.D.N.Y. (District Judge Sidney H. Stein)", "year": "2026", "url": "https://storage.courtlistener.com/recap/gov.uscourts.nysd.640396/gov.uscourts.nysd.640396.1021.0.pdf" } ] }, { "id": "cheap-inference-5505524c", "claim": "A 2026 FHE system ran Llama-3-8B at about 18 seconds per output token on eight RTX PRO 6000 GPUs, and IEEE Spectrum reports FHE on current hardware is thousands to tens of thousands of times slower than unencrypted computing.", "evidence_type": "reporting", "kind": "independent-research-and-secondhand-report", "section_url": "https://lugano.ai/research/cheap-inference/#mathematics-on-a-slow-clock", "sources": [ { "id": 25, "title": "Scaling up FHE-based Privacy-Preserving ML: Higher Throughput, Longer Inputs for LLama-3-8B", "author": "Park, Park, Park, Ahn, Cheon, Hanrot, Kim, Park, Stehlé", "year": "2026", "url": "https://arxiv.org/abs/2601.18511" }, { "id": 28, "title": "Intel Demos Chip to Compute With Encrypted Data", "author": "Samuel K. Moore (IEEE Spectrum)", "year": "2026", "url": "https://spectrum.ieee.org/fhe-intel" } ] }, { "id": "cheap-inference-f76a34cd", "claim": "VaultGemma's differential-privacy guarantee is sequence-level (epsilon at most 2.0, delta at most 1.1e-10, 1,024-token sequences), and Google says user-level privacy is the better choice where data maps to users.", "evidence_type": "first-party", "kind": "first-party-documentation", "section_url": "https://lugano.ai/research/cheap-inference/#mathematics-on-a-slow-clock", "sources": [ { "id": 33, "title": "VaultGemma: The world's most capable differentially private LLM", "author": "Amer Sinha, Ryan McKenna (Google Research)", "year": "2025", "url": "https://research.google/blog/vaultgemma-the-worlds-most-capable-differentially-private-llm/" }, { "id": 34, "title": "VaultGemma: A Differentially Private Gemma Model (technical report)", "author": "Google Research and Google DeepMind", "year": "2025", "url": "https://services.google.com/fh/files/blogs/vaultgemma_tech_report.pdf" } ] }, { "id": "cheap-inference-ddf847da", "claim": "PAPILLON’s local rewriting pipeline kept quality on 85.5% of 237 held-out real queries, from a 901-query benchmark, while leaking 7.5% of personal details.", "evidence_type": "research", "kind": "peer-reviewed-research", "section_url": "https://lugano.ai/research/cheap-inference/#what-leaves-the-device", "sources": [ { "id": 35, "title": "PAPILLON: Privacy Preservation from Internet-based and Local Language Model Ensembles", "author": "Li Siyan, Vethavikashini Chithrra Raghuram, Omar Khattab, Julia Hirschberg, Zhou Yu", "year": "2025", "url": "https://arxiv.org/abs/2410.17127" } ] }, { "id": "cheap-inference-380dedac", "claim": "After Azure Language Service anonymization, GPT-4 still inferred 66.3% of personal attributes, against 86.7% on the original text.", "evidence_type": "research", "kind": "independent-research", "section_url": "https://lugano.ai/research/cheap-inference/#what-leaves-the-device", "sources": [ { "id": 36, "title": "Large Language Models are Advanced Anonymizers", "author": "Robin Staab, Mark Vero, Mislav Balunović, Martin Vechev", "year": "2025", "url": "https://arxiv.org/abs/2402.13846" } ] }, { "id": "cheap-inference-d36e0003", "claim": "Liquid AI released d1-ultra on 15 October 2026: a decision model that reads text and images in one forward pass and returns probabilities for yes/no, choice or scale questions without generating tokens, priced at $0.042 per million input tokens with no output billed.", "evidence_type": "first-party", "kind": "first-party-documentation", "section_url": "https://lugano.ai/research/cheap-inference/#the-price-of-thought", "sources": [ { "id": 37, "title": "d1-ultra: Introducing the World’s Best Decision Model", "author": "Liquid AI", "year": "2026", "url": "https://www.liquid.ai/blog/d1-ultra" }, { "id": 38, "title": "Decision models (documentation)", "author": "Liquid AI", "year": "2026", "url": "https://docs.liquid.ai/lfm/models/decision-models" } ] }, { "id": "cheap-inference-267a00bf", "claim": "Artificial Analysis lists d1-ultra first of 20 models on its Decision Index with a score of 65, against a median of 53; at the index’s launch two days before d1-ultra, it found accuracy below stated probability for all decision models tested, and decision models trailing language models on knowledge and reasoning.", "evidence_type": "research", "kind": "independent-measurement", "section_url": "https://lugano.ai/research/cheap-inference/#the-price-of-thought", "sources": [ { "id": 39, "title": "Artificial Analysis Decision Index v1.0", "author": "Artificial Analysis", "year": "2026", "url": "https://artificialanalysis.ai/articles/artificial-analysis-decision-index" }, { "id": 40, "title": "d1-ultra: Release, Decision Index Score, Performance & Price", "author": "Artificial Analysis", "year": "2026", "url": "https://artificialanalysis.ai/decision-models/d1-ultra" } ] }, { "id": "cheap-inference-2e8ad032", "claim": "Our worked example: one yes/no question of about 50 tokens put to each of a million stored records of about 2,000 tokens costs about $86 at d1-ultra’s list price (2,050 x 1,000,000 x $0.042 per million tokens), assuming text only, one question per call and no discount.", "evidence_type": "our-study", "kind": "our-calculation", "section_url": "https://lugano.ai/research/cheap-inference/#the-price-of-thought", "sources": [ { "id": 37, "title": "d1-ultra: Introducing the World’s Best Decision Model", "author": "Liquid AI", "year": "2026", "url": "https://www.liquid.ai/blog/d1-ultra" }, { "id": 38, "title": "Decision models (documentation)", "author": "Liquid AI", "year": "2026", "url": "https://docs.liquid.ai/lfm/models/decision-models" } ] }, { "id": "cheap-inference-4973eb5d", "claim": "Liquid publishes open-weight decision models, including d1-2B with 1.92 billion parameters, pitched for routing, triage, moderation and guardrails. Using one as an on-device privacy gate before a prompt is sent is our untested proposal.", "evidence_type": "proposal", "kind": "proposal", "section_url": "https://lugano.ai/research/cheap-inference/#what-leaves-the-device", "sources": [ { "id": 38, "title": "Decision models (documentation)", "author": "Liquid AI", "year": "2026", "url": "https://docs.liquid.ai/lfm/models/decision-models" }, { "id": 41, "title": "d1-2B model card", "author": "Liquid AI (Hugging Face)", "year": "2026", "url": "https://huggingface.co/LiquidAI/d1-2B" } ] } ] }, { "slug": "developer-tool-attacks", "title": "How did a developer’s toolbox become the way into Binance?", "url": "https://lugano.ai/research/developer-tool-attacks/", "published": "2026-11-03", "revised": "2026-11-04", "in_short": "Binance found no evidence its keys leaked, yet the ledger shows its hot wallet signed 50 EIP-7702 authorizations letting it run the attacker’s code. Attackers have more ways in than any defender can close, but only a few systems can sign for a hot wallet, so we’d put the check there. If Binance’s review shows its signer refused delegations by default and the attacker found another path, we’d shift weight to the controls around it.", "claims": [ { "id": "developer-tool-attacks-485365d3", "claim": "Binance reported that between 20:05 and 20:09 UTC on 29 October 2026 five of its hot wallets sent 233.46 million XRP to an attacker-controlled address, followed by about 970,500 SOL, 44.2 million OP and 18,270 BTC.", "evidence_type": "first-party", "kind": "first-party incident disclosure", "section_url": "https://lugano.ai/research/developer-tool-attacks/#four-hours", "sources": [ { "id": 1, "title": "29 October 2026 Binance Security Incident: Initial Findings and Response Update", "author": "Binance", "year": "2026", "url": "https://www.binance.com/en/square/post/384312159834579" } ] }, { "id": "developer-tool-attacks-71df159f", "claim": "Hypernative and CoinDesk report that at 20:20:59 UTC one Ethereum transaction carried 50 EIP-7702 authorizations for consecutive nonces of Binance 14, that nonce 18,914,809 took effect, and that a sweep at 20:24:23 UTC moved 167,464 ETH and 63 tokens.", "evidence_type": "research", "kind": "independent on-chain analysis", "section_url": "https://lugano.ai/research/developer-tool-attacks/#four-hours", "sources": [ { "id": 6, "title": "Inside the Largest Crypto Theft of All-Time: The $6.3B Binance Hot-Wallet Drain", "author": "Hypernative", "year": "2026", "url": "https://www.hypernative.io/insights/blog/inside-the-largest-crypto-theft-of-all-time-the-6-3b-binance-hot-wallet-drain" }, { "id": 7, "title": "Here’s how an Ethereum upgrade helped drain part of Binance’s $6 billion loss", "author": "Shaurya Malwa, CoinDesk", "year": "2026", "url": "https://www.coindesk.com/tech/2026/10/30/here-s-how-one-ethereum-permission-let-an-attacker-drain-usd2-5-billion-from-binance" } ] }, { "id": "developer-tool-attacks-a7382c8d", "claim": "Binance reported that suspending withdrawals did not invalidate the on-chain EIP-7702 authorization, that MPC custody meant no single private key could revoke it immediately, and that it cleared the delegation at 00:10 UTC on 30 October 2026.", "evidence_type": "first-party", "kind": "first-party incident disclosure", "section_url": "https://lugano.ai/research/developer-tool-attacks/#the-delegation", "sources": [ { "id": 1, "title": "29 October 2026 Binance Security Incident: Initial Findings and Response Update", "author": "Binance", "year": "2026", "url": "https://www.binance.com/en/square/post/384312159834579" } ] }, { "id": "developer-tool-attacks-5a5cf854", "claim": "Binance reported about USD 6.34 billion in digital assets impacted and about USD 2.85 billion frozen or intercepted, subject to reconciliation and market price volatility.", "evidence_type": "first-party", "kind": "first-party incident disclosure", "section_url": "https://lugano.ai/research/developer-tool-attacks/#the-totals", "sources": [ { "id": 1, "title": "29 October 2026 Binance Security Incident: Initial Findings and Response Update", "author": "Binance", "year": "2026", "url": "https://www.binance.com/en/square/post/384312159834579" } ] }, { "id": "developer-tool-attacks-dc9d9e29", "claim": "Independent totals range from about USD 6.36 billion at time-of-transfer prices (TRM Labs) to USD 6.43 billion at time-of-theft prices (Elliptic, which excludes USD 169 million it judges to be Binance moving its own funds), with Chainalysis reporting about USD 6.4 billion.", "evidence_type": "research", "kind": "independent on-chain analysis", "section_url": "https://lugano.ai/research/developer-tool-attacks/#the-totals", "sources": [ { "id": 3, "title": "North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History", "author": "TRM Labs", "year": "2026", "url": "https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history" }, { "id": 4, "title": "The largest theft in history: North Korea likely behind the $6.4 billion Binance hack", "author": "Tom Robinson, Elliptic", "year": "2026", "url": "https://www.elliptic.co/insights/binance-largest-hack-in-history/" }, { "id": 5, "title": "Binance Hack: Tracing the $6.4 Billion Theft to North Korea", "author": "Chainalysis", "year": "2026", "url": "https://www.chainalysis.com/blog/binance-exploit-latest-findings-and-response/" } ] }, { "id": "developer-tool-attacks-987feb78", "claim": "Binance’s 30 October update described a possibly compromised DevOps engineer’s laptop used to reach a service container and found no evidence of a wallet private-key leak; its 3 November report describes a campaign that began in June 2026.", "evidence_type": "first-party", "kind": "first-party incident disclosure", "section_url": "https://lugano.ai/research/developer-tool-attacks/#the-campaign", "sources": [ { "id": 2, "title": "Security Incident Update (2026-10-30)", "author": "Binance", "year": "2026", "url": "https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7" }, { "id": 1, "title": "29 October 2026 Binance Security Incident: Initial Findings and Response Update", "author": "Binance", "year": "2026", "url": "https://www.binance.com/en/square/post/384312159834579" } ] }, { "id": "developer-tool-attacks-97be3c6d", "claim": "The FBI attributed the theft to North Korean actors tracked as TraderTraitor in an alert dated 31 October 2026; this essay relies on BleepingComputer’s account of the alert because we could not open the FBI’s own page.", "evidence_type": "official", "kind": "government attribution, secondhand", "section_url": "https://lugano.ai/research/developer-tool-attacks/#the-campaign", "sources": [ { "id": 8, "title": "North Korea Responsible for $6 Billion+ Binance Attack", "author": "Federal Bureau of Investigation", "year": "2026", "url": "https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack" }, { "id": 9, "title": "FBI links $6.3 billion Binance crypto heist to North Korean hackers", "author": "Lawrence Abrams, BleepingComputer", "year": "2026", "url": "https://www.bleepingcomputer.com/news/security/fbi-links-63-billion-binance-crypto-heist-to-north-korean-hackers/" } ] }, { "id": "developer-tool-attacks-e710f8bf", "claim": "Binance reported that in June 2026 a Wallet DevOps engineer downloaded a tampered Homebrew installation while trying to install a popular AI coding tool found through a search engine, and that despite device replacement and credential rotation the engineer’s role and colleagues were exposed.", "evidence_type": "first-party", "kind": "first-party incident disclosure", "section_url": "https://lugano.ai/research/developer-tool-attacks/#the-campaign", "sources": [ { "id": 1, "title": "29 October 2026 Binance Security Incident: Initial Findings and Response Update", "author": "Binance", "year": "2026", "url": "https://www.binance.com/en/square/post/384312159834579" } ] }, { "id": "developer-tool-attacks-d468b000", "claim": "Binance reported that in September 2026 a fake recruitment process led an engineer to download an assignment repository onto his work computer whose setup code replaced pyenv in the Homebrew Cellar with a malicious version; Binance’s security chief told reporters the malware was a zero-day that endpoint security missed.", "evidence_type": "first-party", "kind": "first-party incident disclosure", "section_url": "https://lugano.ai/research/developer-tool-attacks/#the-campaign", "sources": [ { "id": 1, "title": "29 October 2026 Binance Security Incident: Initial Findings and Response Update", "author": "Binance", "year": "2026", "url": "https://www.binance.com/en/square/post/384312159834579" }, { "id": 10, "title": "Binance’s $6.3 billion hack began with a fake job interview, and a campaign ‘built over many months’", "author": "Oliver Knight, CoinDesk", "year": "2026", "url": "https://www.coindesk.com/business/2026/11/03/binance-s-usd6-3-billion-hack-began-with-a-fake-job-interview-exchange-says" } ] }, { "id": "developer-tool-attacks-c1a7e047", "claim": "Binance reported that on 20 October 2026 the attacker used a compromised computer and an internal AI tool to gain control over two wallet engineers and found a container deployment permission token; the report does not name the tool or explain the mechanism.", "evidence_type": "first-party", "kind": "first-party incident disclosure", "section_url": "https://lugano.ai/research/developer-tool-attacks/#the-springboard", "sources": [ { "id": 1, "title": "29 October 2026 Binance Security Incident: Initial Findings and Response Update", "author": "Binance", "year": "2026", "url": "https://www.binance.com/en/square/post/384312159834579" } ] }, { "id": "developer-tool-attacks-65fa223c", "claim": "TRM Labs, Elliptic and Chainalysis each describe the Binance theft as the largest crypto theft on record; Elliptic calls it almost certainly the largest single theft of any kind, a nominal-dollar comparison it also made for Bybit in 2025.", "evidence_type": "research", "kind": "independent analysis", "section_url": "https://lugano.ai/research/developer-tool-attacks/#the-record-claim", "sources": [ { "id": 3, "title": "North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History", "author": "TRM Labs", "year": "2026", "url": "https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history" }, { "id": 4, "title": "The largest theft in history: North Korea likely behind the $6.4 billion Binance hack", "author": "Tom Robinson, Elliptic", "year": "2026", "url": "https://www.elliptic.co/insights/binance-largest-hack-in-history/" }, { "id": 5, "title": "Binance Hack: Tracing the $6.4 Billion Theft to North Korea", "author": "Chainalysis", "year": "2026", "url": "https://www.chainalysis.com/blog/binance-exploit-latest-findings-and-response/" }, { "id": 14, "title": "The largest theft in history - following the money trail from the Bybit Hack", "author": "Elliptic", "year": "2025", "url": "https://www.elliptic.co/blog/bybit-hack-largest-in-history" } ] }, { "id": "developer-tool-attacks-3254133f", "claim": "The FBI attributed the roughly USD 1.5 billion Bybit theft of 21 February 2025 to TraderTraitor, and the Safe Ecosystem Foundation said a compromised Safe{Wallet} developer machine was used to propose a disguised malicious transaction.", "evidence_type": "official", "kind": "government attribution and first-party statement", "section_url": "https://lugano.ai/research/developer-tool-attacks/#earlier-thefts", "sources": [ { "id": 13, "title": "North Korea Responsible for $1.5 Billion Bybit Hack (I-022625-PSA)", "author": "Federal Bureau of Investigation, IC3", "year": "2025", "url": "https://www.ic3.gov/PSA/2025/PSA250226" }, { "id": 15, "title": "February 28th, 2025: Statement by the Safe Ecosystem Foundation", "author": "Safe Ecosystem Foundation", "year": "2025", "url": "https://safefoundation.org/blog/safe-ecosystem-foundation-statement" } ] }, { "id": "developer-tool-attacks-084da0d6", "claim": "In September 2024 the FBI warned the crypto industry about North Korean fake recruiters and pre-employment tests and advised against running such code on company devices.", "evidence_type": "official", "kind": "government advisory", "section_url": "https://lugano.ai/research/developer-tool-attacks/#earlier-thefts", "sources": [ { "id": 12, "title": "North Korea Aggressively Targeting Crypto Industry with Well-Disguised Social Engineering Attacks (I-090324-PSA)", "author": "Federal Bureau of Investigation, IC3", "year": "2024", "url": "https://www.ic3.gov/PSA/2024/PSA240903" } ] }, { "id": "developer-tool-attacks-8b7ab779", "claim": "Sponsored search results and cloned install pages impersonated Homebrew in January 2025, and reports published in March and May 2026 describe the same lure impersonating Claude Code; all three describe commodity stealers, and none attributes the activity to a state actor.", "evidence_type": "research", "kind": "vendor threat research", "section_url": "https://lugano.ai/research/developer-tool-attacks/#the-toolbox", "sources": [ { "id": 25, "title": "Dangerous macOS malware is spread via fake Homebrew ads", "author": "Ray Fernandez, Moonlock", "year": "2025", "url": "https://moonlock.com/macos-malware-homebrew-ads" }, { "id": 26, "title": "InstallFix: How attackers are weaponizing malvertised install guides", "author": "Jacques Louw, Push Security", "year": "2026", "url": "https://pushsecurity.com/blog/installfix" }, { "id": 27, "title": "MacSync Stealer: How a Google Ad Turned Install Claude Code into Full Mac Compromise", "author": "Giovanni Braccini, Beelzebub Labs", "year": "2026", "url": "https://beelzebub.ai/blog/macsync-stealer-fake-claude-code-google-ads/" } ] }, { "id": "developer-tool-attacks-c1e45c9d", "claim": "Microsoft reported in March 2026 that Contagious Interview repositories can run code through VS Code task configuration once a user trusts the repository author, and recommended doing coding tests in an isolated environment, such as a non-persistent virtual machine.", "evidence_type": "research", "kind": "vendor threat research", "section_url": "https://lugano.ai/research/developer-tool-attacks/#the-toolbox", "sources": [ { "id": 22, "title": "Contagious Interview: Malware delivered through fake developer job interviews", "author": "Microsoft Defender Experts", "year": "2026", "url": "https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/" } ] }, { "id": "developer-tool-attacks-d08e14eb", "claim": "In the August 2025 Nx compromise the malicious install script tried to use local AI command-line tools to search for secrets; GitGuardian counted 366 systems where this was attempted and 95 where the requested inventory file was written.", "evidence_type": "first-party", "kind": "first-party postmortem and independent measurement", "section_url": "https://lugano.ai/research/developer-tool-attacks/#the-toolbox", "sources": [ { "id": 28, "title": "S1ngularity - What Happened, How We Responded, What We Learned", "author": "Juri Strumpflohner, Nx", "year": "2025", "url": "https://nx.dev/blog/s1ngularity-postmortem" }, { "id": 29, "title": "The Nx s1ngularity Attack: Inside the Credential Leak", "author": "Guillaume Valadon and Anna Nabiullina, GitGuardian", "year": "2025", "url": "https://blog.gitguardian.com/the-nx-s1ngularity-attack-inside-the-credential-leak/" } ] }, { "id": "developer-tool-attacks-54481308", "claim": "Microsoft assessed on 29 October 2026 that North Korean clusters likely use AI development platforms such as Cursor but that their AI-enabled operations remain human-directed and not fully autonomous.", "evidence_type": "research", "kind": "vendor threat research", "section_url": "https://lugano.ai/research/developer-tool-attacks/#the-springboard", "sources": [ { "id": 36, "title": "Tracking AI adoption in North Korean threat actor tradecraft", "author": "Microsoft Threat Intelligence", "year": "2026", "url": "https://www.microsoft.com/en-us/security/blog/2026/10/29/tracking-ai-adoption-in-north-korean-threat-actor-tradecraft/" } ] }, { "id": "developer-tool-attacks-73444b2d", "claim": "The EIP-7702 specification makes a delegation persist until the account signs a replacement or clears it by authorizing the zero address, and warns that delegates are security-critical.", "evidence_type": "official", "kind": "protocol specification", "section_url": "https://lugano.ai/research/developer-tool-attacks/#the-delegation", "sources": [ { "id": 38, "title": "EIP-7702: Set Code for EOAs", "author": "Vitalik Buterin, Sam Wilson, Ansgar Dietrichs and lightclient", "year": "2024", "url": "https://eips.ethereum.org/EIPS/eip-7702" } ] }, { "id": "developer-tool-attacks-df360943", "claim": "Hypernative reports that the delegation applied to the address rather than a key and that the attacker used the delegated Binance 14 wallet to pull about USD 823 million in USDC from a smart account it owned; TRM reports Circle froze 823 million USDC at 21:04 UTC.", "evidence_type": "research", "kind": "independent on-chain analysis", "section_url": "https://lugano.ai/research/developer-tool-attacks/#the-delegation", "sources": [ { "id": 6, "title": "Inside the Largest Crypto Theft of All-Time: The $6.3B Binance Hot-Wallet Drain", "author": "Hypernative", "year": "2026", "url": "https://www.hypernative.io/insights/blog/inside-the-largest-crypto-theft-of-all-time-the-6-3b-binance-hot-wallet-drain" }, { "id": 3, "title": "North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History", "author": "TRM Labs", "year": "2026", "url": "https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history" } ] }, { "id": "developer-tool-attacks-ccc060dd", "claim": "Homebrew documents bottle attestation verification as applying only if HOMEBREW_VERIFY_ATTESTATIONS is set, and the check runs when bottles are fetched; Lugano infers that it would not detect a later change to an installed file such as the pyenv swap.", "evidence_type": "our-analysis", "kind": "documentation and Lugano inference", "section_url": "https://lugano.ai/research/developer-tool-attacks/#control-evidence", "sources": [ { "id": 41, "title": "Installation", "author": "Homebrew documentation", "year": "2026", "url": "https://docs.brew.sh/Installation" }, { "id": 42, "title": "Homebrew manpage (environment) and Library/Homebrew/env_config.rb", "author": "Homebrew", "year": "2026", "url": "https://docs.brew.sh/Manpage" }, { "id": 43, "title": "A peek into build provenance for Homebrew", "author": "Joe Sweeney and William Woodruff, Trail of Bits", "year": "2024", "url": "https://blog.trailofbits.com/2024/05/14/a-peek-into-build-provenance-for-homebrew/" } ] }, { "id": "developer-tool-attacks-196f69af", "claim": "Lugano’s view is that a hot-wallet signer should refuse, under a policy the deployment plane cannot change, transaction types normal operations never produce, such as EIP-7702 set-code authorizations; this is an opinion drawn from the cited record, not a tested result.", "evidence_type": "our-analysis", "kind": "Lugano assessment", "section_url": "https://lugano.ai/research/developer-tool-attacks/#our-view", "sources": [ { "id": 1, "title": "29 October 2026 Binance Security Incident: Initial Findings and Response Update", "author": "Binance", "year": "2026", "url": "https://www.binance.com/en/square/post/384312159834579" }, { "id": 6, "title": "Inside the Largest Crypto Theft of All-Time: The $6.3B Binance Hot-Wallet Drain", "author": "Hypernative", "year": "2026", "url": "https://www.hypernative.io/insights/blog/inside-the-largest-crypto-theft-of-all-time-the-6-3b-binance-hot-wallet-drain" }, { "id": 38, "title": "EIP-7702: Set Code for EOAs", "author": "Vitalik Buterin, Sam Wilson, Ansgar Dietrichs and lightclient", "year": "2024", "url": "https://eips.ethereum.org/EIPS/eip-7702" } ] } ] }, { "slug": "health-record", "title": "Who keeps the record when health leaves the clinic?", "url": "https://lugano.ai/research/health-record/", "published": "2026-11-03", "revised": "2026-11-04", "in_short": "Outside HIPAA, a federal breach-notice rule, a few state laws and the holder’s own promises may guard a copied record. Those promises can change, and they can pass to a buyer. We’d change our view if HHS or a court said a copy sent to a consumer app at the patient’s direction stays under HIPAA, or if a published test found full histories clearly safer.", "claims": [ { "id": "health-record-71702e44", "claim": "At a House Oversight hearing on 10 June 2025, 23andMe interim chief executive Joseph Selsavage testified that about 1.9 million customers, roughly 15 percent, had asked for their data to be deleted since the company announced its bankruptcy.", "evidence_type": "official", "kind": "sworn testimony", "section_url": "https://lugano.ai/research/health-record/#the-promise-and-the-sale", "sources": [ { "id": 1, "title": "Securing Americans’ Genetic Information: Privacy and National Security Concerns Surrounding 23andMe’s Bankruptcy Sale (Serial No. 119-32)", "author": "U.S. House Committee on Oversight and Government Reform", "year": "2025", "url": "https://www.govinfo.gov/content/pkg/CHRG-119hhrg60682/html/CHRG-119hhrg60682.htm" } ] }, { "id": "health-record-cbfa009f", "claim": "In an opinion dated 27 June 2025 the bankruptcy court approved the sale of 23andMe to TTAM Research Institute for $305 million without requiring customer opt-in consent, citing in part a significant risk that the sale would not close.", "evidence_type": "official", "kind": "court opinion", "section_url": "https://lugano.ai/research/health-record/#the-promise-and-the-sale", "sources": [ { "id": 2, "title": "Memorandum Opinion, In re 23andMe Holding Co., Case No. 25-40976-357 (Doc. 908)", "author": "U.S. Bankruptcy Court, Eastern District of Missouri", "year": "2025", "url": "https://www.govinfo.gov/content/pkg/USCOURTS-moeb-4_25-bk-40976/pdf/USCOURTS-moeb-4_25-bk-40976-0.pdf" } ] }, { "id": "health-record-608fe3be", "claim": "At the close on 3 November 2026 CompaniesMarketCap ranked NVIDIA first at about $4.99 trillion and Eli Lilly 12th, with no other healthcare or pharmaceutical company in the top 20.", "evidence_type": "reporting", "kind": "market data (dated aggregator)", "section_url": "https://lugano.ai/research/health-record/#the-biggest-company", "sources": [ { "id": 7, "title": "Largest companies by market capitalization; Eli Lilly, NVIDIA and UnitedHealth market-cap pages", "author": "CompaniesMarketCap", "year": "2026", "url": "https://companiesmarketcap.com/eli-lilly/marketcap/" } ] }, { "id": "health-record-10100754", "claim": "Tirzepatide, sold as Mounjaro and Zepbound, brought in most of Eli Lilly’s revenue in the first nine months of 2026, by our sum of the company’s reported figures.", "evidence_type": "first-party", "kind": "company financial disclosure", "section_url": "https://lugano.ai/research/health-record/#the-biggest-company", "sources": [ { "id": 9, "title": "Lilly reports third-quarter 2026 financial results (Form 8-K, Exhibit 99.1)", "author": "Eli Lilly and Company", "year": "2026", "url": "https://www.sec.gov/Archives/edgar/data/59478/000005947826000104/q326lillysalesandearningsp.htm" } ] }, { "id": "health-record-584a5fef", "claim": "Four of the six younger companies the a16z report names as contenders for the healthcare home (Function Health, General Medicine, Counsel Health and Ferry Health), and OpenAI, appear on a16z’s portfolio page; Eli Lilly contributes all the capital to an a16z-managed biotech fund of up to $500 million announced in January 2025, and invested alongside a16z in General Medicine’s October 2026 Series B, which a16z led.", "evidence_type": "first-party", "kind": "investor disclosures", "section_url": "https://lugano.ai/research/health-record/#the-biggest-company", "sources": [ { "id": 11, "title": "Portfolio", "author": "Andreessen Horowitz", "year": "2026", "url": "https://a16z.com/portfolio/" }, { "id": 12, "title": "Andreessen Horowitz Partners with Lilly to Launch First-of-Its-Kind Biotech Ecosystem Fund", "author": "Andreessen Horowitz", "year": "2025", "url": "https://a16z.com/announcement-andreessen-horowitz-partners-with-lilly-to-launch-first-of-its-kind-biotech-ecosystem-venture-fund/" }, { "id": 13, "title": "General Medicine Raises $120 Million to Build the Healthcare Store", "author": "General Medicine (PR Newswire)", "year": "2026", "url": "https://www.prnewswire.com/news-releases/general-medicine-raises-120-million-to-build-the-healthcare-store-302899356.html" } ] }, { "id": "health-record-d2ea0e09", "claim": "In the two versions whose text we recorded (a16z.com and a16z.news), the a16z report text describes its survey method only as 500 randomly selected US consumers, mentions none of a16z’s ties to the companies it names, and publishes no panel provider, field dates, weighting or margin of error.", "evidence_type": "our-analysis", "kind": "Lugano review of a published report", "section_url": "https://lugano.ai/research/health-record/#the-biggest-company", "sources": [ { "id": 4, "title": "The State of Longevity", "author": "Daisy Wolf and Eva Steinman (Andreessen Horowitz)", "year": "2026", "url": "https://a16z.com/the-state-of-longevity/" }, { "id": 67, "title": "The State of Longevity (a16z.news newsletter version)", "author": "Daisy Wolf and Eva Steinman (Andreessen Horowitz)", "year": "2026", "url": "https://www.a16z.news/p/the-state-of-longevity" } ] }, { "id": "health-record-eead3c8c", "claim": "HHS guidance says that health information a covered entity sends, at the individual’s direction, to an app that is neither a covered entity nor a business associate is no longer protected by the HIPAA Rules.", "evidence_type": "official", "kind": "regulator guidance", "section_url": "https://lugano.ai/research/health-record/#where-hipaa-stops", "sources": [ { "id": 6, "title": "The access right, health apps, & APIs (HIPAA FAQs)", "author": "U.S. Department of Health and Human Services, Office for Civil Rights", "year": "2025", "url": "https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access-right-health-apps-apis/index.html" } ] }, { "id": "health-record-9ef10be4", "claim": "OpenAI said in January 2026 that Health conversations would not train its foundation models and that Health information would never flow into other chats; by July 2026 it let connected health information be used across conversations and limited the training exclusion to connected data and the conversations that use it.", "evidence_type": "first-party", "kind": "first-party product documentation", "section_url": "https://lugano.ai/research/health-record/#promises-moved", "sources": [ { "id": 15, "title": "Introducing ChatGPT Health", "author": "OpenAI", "year": "2026", "url": "https://openai.com/index/introducing-chatgpt-health/" }, { "id": 16, "title": "Launching Health in ChatGPT", "author": "OpenAI", "year": "2026", "url": "https://openai.com/index/health-in-chatgpt/" }, { "id": 17, "title": "Health in ChatGPT (Help Center)", "author": "OpenAI", "year": "2026", "url": "https://help.openai.com/en/articles/20001036-health-in-chatgpt" } ] }, { "id": "health-record-7e652a39", "claim": "OpenAI says Health in ChatGPT is not intended for covered-entity use and does not offer a Business Associate Agreement; its Health Privacy Notice, updated 29 June 2026, says that by default Health data is not used to improve its foundation models but contains no statement about advertising, and OpenAI’s main privacy policy says personal data may be transferred to a successor in a bankruptcy or other transaction.", "evidence_type": "our-analysis", "kind": "first-party documentation and Lugano review", "section_url": "https://lugano.ai/research/health-record/#promises-moved", "sources": [ { "id": 17, "title": "Health in ChatGPT (Help Center)", "author": "OpenAI", "year": "2026", "url": "https://help.openai.com/en/articles/20001036-health-in-chatgpt" }, { "id": 18, "title": "Health Privacy Notice", "author": "OpenAI", "year": "2026", "url": "https://openai.com/policies/health-privacy-policy/" }, { "id": 65, "title": "Privacy policy (US)", "author": "OpenAI", "year": "2026", "url": "https://openai.com/policies/privacy-policy/" } ] }, { "id": "health-record-1af4d4ae", "claim": "Google tells US users that medical records sent from a provider to Google Health, or uploaded, are no longer subject to HIPAA protections; Microsoft calls Copilot Health a direct-to-consumer wellness product and says HIPAA does not apply to most such products.", "evidence_type": "first-party", "kind": "first-party documentation", "section_url": "https://lugano.ai/research/health-record/#where-hipaa-stops", "sources": [ { "id": 19, "title": "FAQs on privacy: Google Health", "author": "Google", "year": "2026", "url": "https://support.google.com/product-documentation/answer/13532616?hl=en" }, { "id": 20, "title": "About Copilot Health", "author": "Microsoft", "year": "2026", "url": "https://support.microsoft.com/en-US/microsoft-copilot/copilot-health" } ] }, { "id": "health-record-29633949", "claim": "Amazon says its Health AI runs in a HIPAA-compliant environment and that it trains Health AI models on abstracted patterns without directly identifying information.", "evidence_type": "first-party", "kind": "first-party statement", "section_url": "https://lugano.ai/research/health-record/#where-hipaa-stops", "sources": [ { "id": 22, "title": "Amazon launches Health AI agent on Amazon website and app with free 24/7 access to virtual care for Prime members", "author": "Amazon (About Amazon)", "year": "2026", "url": "https://www.aboutamazon.com/news/retail/amazon-health-ai-agent-one-medical" } ] }, { "id": "health-record-94014482", "claim": "In KFF’s February–March 2026 poll, 41 percent of adults who used AI for physical or mental health information had uploaded personal medical information, 13 percent of all adults.", "evidence_type": "reporting", "kind": "survey", "section_url": "https://lugano.ai/research/health-record/#the-outside-record", "sources": [ { "id": 23, "title": "KFF Tracking Poll on Health Information and Trust: Use of AI for Health Information and Advice", "author": "KFF", "year": "2026", "url": "https://www.kff.org/public-opinion/kff-tracking-poll-on-health-information-and-trust-use-of-ai-for-health-information-and-advice/" } ] }, { "id": "health-record-fbebf42a", "claim": "The FTC brought its first Health Breach Notification Rule case, against GoodRx, in February 2023, two years after two commissioners wrote that the rule had never been enforced; the 2024 amendments, effective 29 July 2024, cover health apps and treat unauthorized disclosure as a breach.", "evidence_type": "official", "kind": "regulator records", "section_url": "https://lugano.ai/research/health-record/#a-rule-about-notice", "sources": [ { "id": 25, "title": "Joint Statement of Commissioner Rohit Chopra and Commissioner Rebecca Kelly Slaughter, In the Matter of Flo Health", "author": "Rohit Chopra and Rebecca Kelly Slaughter (FTC)", "year": "2021", "url": "https://search.ftc.gov/system/files/documents/public_statements/1586018/20210112_final_joint_rcrks_statement_on_flo.pdf" }, { "id": 26, "title": "FTC Enforcement Action to Bar GoodRx from Sharing Consumers’ Sensitive Health Info for Advertising", "author": "Federal Trade Commission", "year": "2023", "url": "https://www.ftc.gov/news-events/news/press-releases/2023/02/ftc-enforcement-action-bar-goodrx-sharing-consumers-sensitive-health-info-advertising" }, { "id": 24, "title": "Health Breach Notification Rule, final rule (89 FR 47028)", "author": "Federal Trade Commission", "year": "2024", "url": "https://www.govinfo.gov/content/pkg/FR-2024-05-30/pdf/2024-10855.pdf" } ] }, { "id": "health-record-3d3674aa", "claim": "On 9 September 2026 the FTC withdrew its 2021 policy statement on breaches by health apps as obsolete; the release withdraws guidance and does not repeal the rule.", "evidence_type": "official", "kind": "regulator record", "section_url": "https://lugano.ai/research/health-record/#a-rule-about-notice", "sources": [ { "id": 27, "title": "FTC Withdraws Obsolete Policy Statement", "author": "Federal Trade Commission", "year": "2026", "url": "https://www.ftc.gov/news-events/news/press-releases/2026/09/ftc-withdraws-obsolete-policy-statement" } ] }, { "id": "health-record-5e17e4f3", "claim": "The bankruptcy court found that 23andMe’s privacy statement had allowed sale in a merger, acquisition or asset sale since 2007, added bankruptcy in 2022, and dropped a bold statement that it did not sell personal information from its California notice in December 2022.", "evidence_type": "official", "kind": "court finding", "section_url": "https://lugano.ai/research/health-record/#the-promise-and-the-sale", "sources": [ { "id": 2, "title": "Memorandum Opinion, In re 23andMe Holding Co., Case No. 25-40976-357 (Doc. 908)", "author": "U.S. Bankruptcy Court, Eastern District of Missouri", "year": "2025", "url": "https://www.govinfo.gov/content/pkg/USCOURTS-moeb-4_25-bk-40976/pdf/USCOURTS-moeb-4_25-bk-40976-0.pdf" } ] }, { "id": "health-record-65a8a9ef", "claim": "The privacy statement of 23andMe Research Institute, last updated 19 May 2026, permits transfer of personal information in a bankruptcy, merger or asset sale (genetic data only to qualifying US buyers that adopt the statement) and retains genetic information, date of birth and sex after account deletion.", "evidence_type": "first-party", "kind": "first-party policy", "section_url": "https://lugano.ai/research/health-record/#the-promise-and-the-sale", "sources": [ { "id": 33, "title": "Privacy Statement", "author": "23andMe Research Institute", "year": "2026", "url": "https://www.23andme.com/legal/privacy/full-version/" } ] }, { "id": "health-record-6fb6f2fa", "claim": "A federal jury found on 1 August 2025 that Meta violated California’s Invasion of Privacy Act in Frasco v. Flo Health; Google, Flo and Flurry agreed to pay $59.5 million, with final approval not confirmed; as of 20 August 2026 class counsel described a judgment against Meta as not yet entered.", "evidence_type": "official", "kind": "court records", "section_url": "https://lugano.ai/research/health-record/#breaches-and-cases", "sources": [ { "id": 38, "title": "Amended Order re Post-Trial Motions, Frasco v. Flo Health, Inc., No. 21-cv-00757-JD (Dkt. 776)", "author": "U.S. District Court, Northern District of California", "year": "2025", "url": "https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_21-cv-00757/pdf/USCOURTS-cand-3_21-cv-00757-9.pdf" }, { "id": 37, "title": "Long Form Notice of Proposed Settlements, Frasco v. Flo Health", "author": "Class counsel (Labaton Keller Sucharow) for the court", "year": "2026", "url": "https://edge.sitecorecloud.io/lksfirmsite98d9-labatonedc2-prodf3da-8e79/media/Project/Labaton/Master/Master-Site/Cases/Case-Materials/Resolved-Cases/Frasco-v-Flo-Health-Inc/Flo-Settlements-Long-Form-Notice.pdf" }, { "id": 39, "title": "Motion for Attorney Fees and Expenses, Frasco v. Flo Health (Dkt. 843)", "author": "Plaintiffs’ counsel", "year": "2026", "url": "https://edge.sitecorecloud.io/lksfirmsite98d9-labatonedc2-prodf3da-8e79/media/Project/Labaton/Master/Master-Site/Cases/Case-Materials/Resolved-Cases/Frasco-v-Flo-Health-Inc/2026-08-20-MOTION-for-Attorney-Fees-and-Expenses-and-Plaintiffs-Application-for-Service-Awards.pdf" } ] }, { "id": "health-record-2cc8ccc7", "claim": "Change Healthcare notified HHS on 31 July 2025 that approximately 192.7 million individuals were affected by the 2024 ransomware attack, which began with compromised credentials on a Citrix portal without multi-factor authentication.", "evidence_type": "official", "kind": "regulator record and sworn testimony", "section_url": "https://lugano.ai/research/health-record/#inside-the-walls", "sources": [ { "id": 41, "title": "Change Healthcare Cybersecurity Incident Frequently Asked Questions", "author": "U.S. Department of Health and Human Services, Office for Civil Rights", "year": "2025", "url": "https://www.hhs.gov/hipaa/for-professionals/special-topics/change-healthcare-cybersecurity-incident-frequently-asked-questions/index.html" }, { "id": 40, "title": "Testimony of Andrew Witty, CEO, UnitedHealth Group, before the House Energy and Commerce Subcommittee on Oversight and Investigations", "author": "Andrew Witty (UnitedHealth Group)", "year": "2024", "url": "https://www.congress.gov/118/meeting/house/117242/witnesses/HHRG-118-IF02-Wstate-WittyS-20240501-U5.pdf" } ] }, { "id": "health-record-35ed1c6d", "claim": "By Lugano’s tally of the HHS breach portal export of 3 November 2026, large-breach reports submitted in 2024 listed 290,052,596 affected individuals, the highest of any year since 2009; Change Healthcare’s single entry supplies 192.7 million of that, and some people are counted more than once.", "evidence_type": "our-study", "kind": "Lugano aggregation of regulator data", "section_url": "https://lugano.ai/research/health-record/#inside-the-walls", "sources": [ { "id": 42, "title": "Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information", "author": "U.S. Department of Health and Human Services, Office for Civil Rights", "year": "2026", "url": "https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf" } ] }, { "id": "health-record-3f3e02b3", "claim": "FDA’s January 2026 general-wellness guidance says FDA may consider non-invasive products that estimate blood pressure to be low-risk wellness products if their values are validated, they make no disease claims and they meet other conditions; in June 2026 FDA told WHOOP it does not intend to enforce device requirements for Blood Pressure Insights as modified.", "evidence_type": "official", "kind": "regulator guidance and letters", "section_url": "https://lugano.ai/research/health-record/#when-the-holder-is-wrong", "sources": [ { "id": 46, "title": "General Wellness: Policy for Low Risk Devices (guidance)", "author": "U.S. Food and Drug Administration", "year": "2026", "url": "https://www.fda.gov/media/90652/download" }, { "id": 45, "title": "Warning Letter, WHOOP, Inc. (MARCS-CMS 709755)", "author": "U.S. Food and Drug Administration", "year": "2025", "url": "https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/whoop-inc-709755-07142025" }, { "id": 47, "title": "Close-Out Letter, WHOOP, Inc. (MARCS-CMS 709755)", "author": "U.S. Food and Drug Administration", "year": "2026", "url": "https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/whoop-inc-709755-06172026" } ] }, { "id": "health-record-ab0e6bb8", "claim": "In a randomized, preregistered study of 1,298 participants, people using GPT-4o, Llama 3 or Command R+ identified relevant conditions in fewer than 34.5 percent of cases and the correct disposition in fewer than 44.2 percent, no better than controls, while the models alone identified conditions in 94.9 percent.", "evidence_type": "research", "kind": "peer-reviewed randomized study", "section_url": "https://lugano.ai/research/health-record/#when-the-holder-is-wrong", "sources": [ { "id": 48, "title": "Reliability of LLMs as medical assistants for the general public: a randomized preregistered study", "author": "Andrew M. Bean, Rebecca E. Payne, … Luc Rocher, Adam Mahdi (Nature Medicine)", "year": "2026", "url": "https://doi.org/10.1038/s41591-025-04074-y" } ] }, { "id": "health-record-a755bc75", "claim": "In a structured vignette test, ChatGPT Health under-triaged 52 percent of gold-standard emergencies; a later preprint that ran the same four emergency vignettes through six other models, not ChatGPT Health, found pooled under-triage from 17 to 50 percent depending on wording and response format.", "evidence_type": "research", "kind": "peer-reviewed study and preprint", "section_url": "https://lugano.ai/research/health-record/#triage-and-denials", "sources": [ { "id": 49, "title": "ChatGPT Health performance in a structured test of triage recommendations", "author": "Ramaswamy and colleagues (Nature Medicine)", "year": "2026", "url": "https://doi.org/10.1038/s41591-026-04297-7" }, { "id": 50, "title": "Evaluation format, not only model capability, shapes measured triage failure in consumer health AI", "author": "David Fraile Navarro, Jialei Sheng, Farah Magrabi, Enrico Coiera", "year": "2026", "url": "https://arxiv.org/abs/2603.11413" } ] }, { "id": "health-record-215315b3", "claim": "In Estate of Lokken v. UnitedHealth Group, the court allowed contract and implied-covenant claims to proceed in February 2025 on the question whether UnitedHealth kept its statement that clinical staff and physicians make coverage decisions; a class-certification motion is due 16 February 2027.", "evidence_type": "official", "kind": "court records", "section_url": "https://lugano.ai/research/health-record/#triage-and-denials", "sources": [ { "id": 51, "title": "Memorandum Opinion and Order, Estate of Lokken v. UnitedHealth Group, No. 23-cv-03514-JRT-SGE (Doc. 91)", "author": "U.S. District Court, District of Minnesota (Judge John R. Tunheim)", "year": "2025", "url": "https://litigationtracker.law.georgetown.edu/wp-content/uploads/2023/11/Lokken_2025.02.13_MEMORANDUM-OPINION-AND-ORDER.pdf" }, { "id": 52, "title": "Scheduling Order, Estate of Lokken v. UnitedHealth Group (Doc. 211)", "author": "U.S. District Court, District of Minnesota", "year": "2026", "url": "https://litigationtracker.law.georgetown.edu/wp-content/uploads/2023/11/Estate-of-Gene-B.-Lokken-The-et-al-v.-UnitedHealth-Group-Inc.-et-al_2026.09.18_SCHEDULING-ORDER.pdf" } ] }, { "id": "health-record-a973caf1", "claim": "HHS-OIG found that in June 2024 insurers overturned 97 percent of appealed skilled-nursing denials issued by naviHealth, while only 18 percent of skilled-nursing denials were appealed; OIG cannot determine from the data alone how many denials were inappropriate.", "evidence_type": "official", "kind": "inspector-general analysis", "section_url": "https://lugano.ai/research/health-record/#triage-and-denials", "sources": [ { "id": 54, "title": "Medicare Advantage Organizations Overturned Nearly All Appealed Prior Authorization Denials for Skilled Nursing Facility Admission (OEI-09-24-00331)", "author": "HHS Office of Inspector General", "year": "2026", "url": "https://oig.hhs.gov/documents/audit/11694/OEI-09-24-00331.pdf" } ] }, { "id": "health-record-22103c8b", "claim": "Lugano infers that an appeal process which reverses nearly all denials it reviews, but reviews fewer than one in five, provides a weak human check on automated or assisted coverage decisions; this is an inference from the cited figures, not a finding by OIG.", "evidence_type": "our-analysis", "kind": "Lugano assessment", "section_url": "https://lugano.ai/research/health-record/#triage-and-denials", "sources": [ { "id": 54, "title": "Medicare Advantage Organizations Overturned Nearly All Appealed Prior Authorization Denials for Skilled Nursing Facility Admission (OEI-09-24-00331)", "author": "HHS Office of Inspector General", "year": "2026", "url": "https://oig.hhs.gov/documents/audit/11694/OEI-09-24-00331.pdf" } ] }, { "id": "health-record-67aafeef", "claim": "By Cooley’s count, Vermont became the fifth state to classify neural data as sensitive in June 2026, with a central-nervous-system definition effective 1 January 2028; California’s definition covers the central or peripheral nervous system and excludes data inferred from nonneural information; law-firm summaries report that Delaware added neural data to its sensitive categories in September 2026, effective 1 January 2027.", "evidence_type": "official", "kind": "statute text and law-firm summary", "section_url": "https://lugano.ai/research/health-record/#the-next-record", "sources": [ { "id": 62, "title": "Act 145 (S.71), An act relating to consumer data privacy and online surveillance (as enacted)", "author": "Vermont General Assembly", "year": "2026", "url": "https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf" }, { "id": 63, "title": "From Maple to Mind Taps: New Vermont Law Puts Neurotech on Notice", "author": "Cooley LLP", "year": "2026", "url": "https://www.cooley.com/news/insight/2026/2026-06-23-from-maple-to-mind-taps-new-vermont-law-puts-neurotech-on-notice" }, { "id": 61, "title": "California Consumer Privacy Act statute (text effective 1 January 2025, including SB 1223)", "author": "California Privacy Protection Agency", "year": "2025", "url": "https://cppa.ca.gov/regulations/pdf/ccpa_statute.pdf" }, { "id": 66, "title": "Delaware Expands State Privacy Law", "author": "Hunton Andrews Kurth (Privacy and Information Security Law Blog)", "year": "2026", "url": "https://www.hunton.com/privacy-and-cybersecurity-law-blog/delaware-expands-state-privacy-law" } ] }, { "id": "health-record-e06ead21", "claim": "Lugano’s view is that companies offering consumer health assistants should place their training, advertising, retention and change-of-control commitments in the privacy notice itself and require fresh affirmative consent before a merger, sale or bankruptcy widens use; this is an opinion drawn from the cited record, not a tested result.", "evidence_type": "our-analysis", "kind": "Lugano assessment", "section_url": "https://lugano.ai/research/health-record/#our-view", "sources": [ { "id": 18, "title": "Health Privacy Notice", "author": "OpenAI", "year": "2026", "url": "https://openai.com/policies/health-privacy-policy/" }, { "id": 2, "title": "Memorandum Opinion, In re 23andMe Holding Co., Case No. 25-40976-357 (Doc. 908)", "author": "U.S. Bankruptcy Court, Eastern District of Missouri", "year": "2025", "url": "https://www.govinfo.gov/content/pkg/USCOURTS-moeb-4_25-bk-40976/pdf/USCOURTS-moeb-4_25-bk-40976-0.pdf" }, { "id": 33, "title": "Privacy Statement", "author": "23andMe Research Institute", "year": "2026", "url": "https://www.23andme.com/legal/privacy/full-version/" } ] } ] }, { "slug": "mcp-access-study", "title": "What access comes with an AI tool?", "url": "https://lugano.ai/research/mcp-access-study/", "published": "2026-10-20", "revised": "2026-11-04", "in_short": "After hand review, seven of the 50 MCP servers we read have code that names a third-party host no README mentions, in a sample our own audit found flawed. We think a README is often the only document people read before they connect, so we’d look at that gap first. Before you connect, check the hosts a server’s code names and the secrets it reads against its README.", "claims": [ { "id": "mcp-access-study-118cf0e4", "claim": "The sample is 50 packages taken, after unrecorded manual exclusions, from npm candidates ranked by recorded last-month downloads; the ranking recorded zero for most candidates, including some heavily downloaded MCP servers, so the sample is not the 50 most-downloaded MCP servers.", "evidence_type": "our-study", "kind": "local-static-study", "section_url": "https://lugano.ai/research/mcp-access-study/#sample", "sources": [ { "id": 1, "title": "Static source observations from 50 sampled MCP server packages", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/mcp-access-study/#source-1" }, { "id": 2, "title": "The 50-package sample (packages.txt)", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/mcp-access-study/#source-2" }, { "id": 8, "title": "npm downloads API and registry metadata, checked 3 November 2026", "author": "npm, Inc.", "year": "2026", "url": "https://api.npmjs.org/downloads/point/2026-09-20:2026-10-19/chrome-devtools-mcp" } ] }, { "id": "mcp-access-study-273aa8d0", "claim": "An audit on 3 November 2026 found that chrome-devtools-mcp, recorded at zero downloads in the study’s ranking file, had about 8 million downloads in the month before the scan.", "evidence_type": "our-study", "kind": "audit correction", "section_url": "https://lugano.ai/research/mcp-access-study/#sample", "sources": [ { "id": 8, "title": "npm downloads API and registry metadata, checked 3 November 2026", "author": "npm, Inc.", "year": "2026", "url": "https://api.npmjs.org/downloads/point/2026-09-20:2026-10-19/chrome-devtools-mcp" } ] }, { "id": "mcp-access-study-8fd08192", "claim": "The sampled packages had about 19.6 million downloads in the month before the scan.", "evidence_type": "our-study", "kind": "local-static-study", "section_url": "https://lugano.ai/research/mcp-access-study/#sample", "sources": [ { "id": 7, "title": "Scan summary and reviewed headline counts (summary.json, headline.json)", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/mcp-access-study/#source-7" } ] }, { "id": "mcp-access-study-4ce72d4e", "claim": "No package code, npm install or lifecycle script was run.", "evidence_type": "our-study", "kind": "local-static-study", "section_url": "https://lugano.ai/research/mcp-access-study/#method", "sources": [ { "id": 1, "title": "Static source observations from 50 sampled MCP server packages", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/mcp-access-study/#source-1" } ] }, { "id": "mcp-access-study-02d0c10c", "claim": "The scanner first flagged 13 packages with hosts not named in the README and 7 with analytics hosts; manual review kept 7 and 5.", "evidence_type": "our-study", "kind": "local-static-study", "section_url": "https://lugano.ai/research/mcp-access-study/#method", "sources": [ { "id": 4, "title": "Manual review record (review.json)", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/mcp-access-study/#source-4" }, { "id": 7, "title": "Scan summary and reviewed headline counts (summary.json, headline.json)", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/mcp-access-study/#source-7" } ] }, { "id": "mcp-access-study-1a7c338b", "claim": "24 of 50 packages read environment-variable names commonly used for API keys, tokens or secrets.", "evidence_type": "our-study", "kind": "local-static-study", "section_url": "https://lugano.ai/research/mcp-access-study/#broad-reach", "sources": [ { "id": 1, "title": "Static source observations from 50 sampled MCP server packages", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/mcp-access-study/#source-1" }, { "id": 5, "title": "Per-package results (results.json)", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/mcp-access-study/#source-5" } ] }, { "id": "mcp-access-study-a7de5ea7", "claim": "20 of 50 packages contain process-spawning markers.", "evidence_type": "our-study", "kind": "local-static-study", "section_url": "https://lugano.ai/research/mcp-access-study/#broad-reach", "sources": [ { "id": 1, "title": "Static source observations from 50 sampled MCP server packages", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/mcp-access-study/#source-1" }, { "id": 5, "title": "Per-package results (results.json)", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/mcp-access-study/#source-5" } ] }, { "id": "mcp-access-study-4305c68c", "claim": "16 of 50 packages contain home-directory resolution markers.", "evidence_type": "our-study", "kind": "local-static-study", "section_url": "https://lugano.ai/research/mcp-access-study/#broad-reach", "sources": [ { "id": 1, "title": "Static source observations from 50 sampled MCP server packages", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/mcp-access-study/#source-1" }, { "id": 5, "title": "Per-package results (results.json)", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/mcp-access-study/#source-5" } ] }, { "id": "mcp-access-study-c67fa078", "claim": "7 of 50 packages include a third-party endpoint in source that the sampled README does not name.", "evidence_type": "our-study", "kind": "local-static-study", "section_url": "https://lugano.ai/research/mcp-access-study/#readme-and-code", "sources": [ { "id": 1, "title": "Static source observations from 50 sampled MCP server packages", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/mcp-access-study/#source-1" }, { "id": 4, "title": "Manual review record (review.json)", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/mcp-access-study/#source-4" } ] }, { "id": "mcp-access-study-2daf728d", "claim": "5 of 50 packages include analytics or telemetry markers; two sampled READMEs say nothing about them and one shows only a configuration key.", "evidence_type": "our-study", "kind": "local-static-study", "section_url": "https://lugano.ai/research/mcp-access-study/#package-by-package", "sources": [ { "id": 1, "title": "Static source observations from 50 sampled MCP server packages", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/mcp-access-study/#source-1" }, { "id": 4, "title": "Manual review record (review.json)", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/mcp-access-study/#source-4" } ] }, { "id": "mcp-access-study-287a4cbb", "claim": "The distinction that matters is between what a tool needs and what a user is told.", "evidence_type": "our-analysis", "kind": "analysis", "section_url": "https://lugano.ai/research/mcp-access-study/#readme-and-code", "sources": [] }, { "id": "mcp-access-study-31b299f9", "claim": "Static markers do not establish runtime requests, behavior, intent or vulnerabilities.", "evidence_type": "our-analysis", "kind": "local-scope", "section_url": "https://lugano.ai/research/mcp-access-study/#markers", "sources": [ { "id": 1, "title": "Static source observations from 50 sampled MCP server packages", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/mcp-access-study/#source-1" } ] }, { "id": "mcp-access-study-a8246122", "claim": "A runtime study in an instrumented sandbox is proposed and has not been run.", "evidence_type": "proposal", "kind": "proposed-study", "section_url": "https://lugano.ai/research/mcp-access-study/#open-question", "sources": [] } ] }, { "slug": "model-reliability", "title": "Who checks the work when AI gets faster?", "url": "https://lugano.ai/research/model-reliability/", "published": "2026-11-01", "revised": "2026-11-04", "in_short": "On TruthfulQA, a 2022 benchmark built from questions where a common misconception is easy to repeat, the best model its authors tested was truthful on 58%. Confidence and tidy citations aren’t checks, so the time spent checking belongs beside the speed of drafting. We’d change our view if checking automates as well as drafting does, which a small test we’ve designed but not run could show.", "claims": [ { "id": "model-reliability-0929d0ff", "claim": "NIST defines confabulation as confidently stated but erroneous or false content, and notes that such output can be factually inaccurate or internally inconsistent.", "evidence_type": "official", "kind": "official risk framing", "section_url": "https://lugano.ai/research/model-reliability/#a-record-is-not-a-rationale", "sources": [ { "id": 1, "title": "Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile", "author": "National Institute of Standards and Technology", "year": "2024", "url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence" } ] }, { "id": "model-reliability-3443f83b", "claim": "TruthfulQA has 817 questions across 38 categories and reports 58% best-model generation truthfulness; its 94% human baseline was one internet-enabled participant answering 250 sampled questions with a suggested two minutes each.", "evidence_type": "research", "kind": "published historical evaluation", "section_url": "https://lugano.ai/research/model-reliability/#a-record-is-not-a-rationale", "sources": [ { "id": 2, "title": "TruthfulQA: Measuring How Models Mimic Human Falsehoods", "author": "Stephanie Lin, Jacob Hilton, and Owain Evans", "year": "2022", "url": "https://aclanthology.org/2022.acl-long.229/" } ] }, { "id": "model-reliability-bfd57c29", "claim": "The cited sycophancy study observed the behavior across five assistants and found evidence that preference judgments can favor view-matching responses.", "evidence_type": "research", "kind": "published evidence", "section_url": "https://lugano.ai/research/model-reliability/#a-record-is-not-a-rationale", "sources": [ { "id": 5, "title": "Towards Understanding Sycophancy in Language Models", "author": "Mrinank Sharma and colleagues", "year": "2023", "url": "https://arxiv.org/abs/2310.13548" } ] }, { "id": "model-reliability-d9af229c", "claim": "The cited controlled long-context study found performance could vary with the position of relevant information while the correct answer remained fixed.", "evidence_type": "research", "kind": "published evidence", "section_url": "https://lugano.ai/research/model-reliability/#the-document-that-moved", "sources": [ { "id": 3, "title": "Lost in the Middle: How Language Models Use Long Contexts", "author": "Nelson F. Liu and colleagues", "year": "2023", "url": "https://arxiv.org/abs/2307.03172" } ] }, { "id": "model-reliability-b357b8bc", "claim": "RULER evaluated 17 long-context models on 13 synthetic tasks and reported length-related drops for almost all evaluated models despite near-perfect conventional needle retrieval; its main task-complexity analysis uses Yi-34B.", "evidence_type": "research", "kind": "published historical evaluation", "section_url": "https://lugano.ai/research/model-reliability/#the-document-that-moved", "sources": [ { "id": 9, "title": "RULER: What’s the Real Context Size of Your Long-Context Language Models?", "author": "Cheng-Ping Hsieh and colleagues", "year": "2024", "url": "https://arxiv.org/abs/2404.06654" } ] }, { "id": "model-reliability-795b8eff", "claim": "The cited attention-calibration paper reports improved middle-context retrieval and retrieval-augmented-generation results in its evaluated settings.", "evidence_type": "research", "kind": "published counterevidence", "section_url": "https://lugano.ai/research/model-reliability/#the-document-that-moved", "sources": [ { "id": 10, "title": "Found in the Middle: Calibrating Positional Attention Bias Improves Long Context Utilization", "author": "Cheng-Yu Hsieh and colleagues", "year": "2024", "url": "https://arxiv.org/abs/2406.16008" } ] }, { "id": "model-reliability-e9416b56", "claim": "The cited chain-of-thought study found cases where explanations omitted input features that influenced a tested model’s prediction.", "evidence_type": "research", "kind": "published evidence", "section_url": "https://lugano.ai/research/model-reliability/#a-rationale-is-an-interface", "sources": [ { "id": 4, "title": "Language Models Don’t Always Say What They Think: Unfaithful Explanations in Chain-of-Thought Prompting", "author": "Miles Turpin, Julian Michael, Ethan Perez, and Samuel R. Bowman", "year": "2023", "url": "https://arxiv.org/abs/2305.04388" } ] }, { "id": "model-reliability-412ce443", "claim": "In the cited 2025 study, overall faithfulness scores were 25% for Claude 3.7 Sonnet and 39% for DeepSeek R1 across hint types; many individual settings were below 20%, and the paper reported lower faithfulness on GPQA than on MMLU.", "evidence_type": "research", "kind": "published evidence", "section_url": "https://lugano.ai/research/model-reliability/#a-rationale-is-an-interface", "sources": [ { "id": 8, "title": "Reasoning Models Don’t Always Say What They Think", "author": "Yanda Chen and colleagues, Anthropic Alignment Science Team", "year": "2025", "url": "https://assets.anthropic.com/m/71876fabef0f0ed4/original/reasoning_models_paper.pdf" } ] }, { "id": "model-reliability-3b8bda47", "claim": "WebArena provides 812 long-horizon web tasks scored for functional correctness, checking the returned answer or the resulting site state, rather than treating a plausible action trace as task success.", "evidence_type": "research", "kind": "published benchmark design", "section_url": "https://lugano.ai/research/model-reliability/#when-an-answer-becomes-action", "sources": [ { "id": 6, "title": "WebArena: A Realistic Web Environment for Building Autonomous Agents", "author": "Shuyan Zhou and colleagues", "year": "2023", "url": "https://arxiv.org/abs/2307.13854" } ] }, { "id": "model-reliability-c3faa316", "claim": "Indirect prompt injection can place adversarial instructions inside content retrieved by an LLM-integrated application.", "evidence_type": "research", "kind": "published security finding", "section_url": "https://lugano.ai/research/model-reliability/#when-an-answer-becomes-action", "sources": [ { "id": 7, "title": "Not What You’ve Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection", "author": "Kai Greshake and colleagues", "year": "2023", "url": "https://arxiv.org/abs/2302.12173" } ] } ] }, { "slug": "private-ai-verification", "title": "Who checks that private AI is private?", "url": "https://lugano.ai/research/private-ai-verification/", "published": "2026-11-03", "revised": "2026-11-04", "in_short": "Of the 17 private-AI offerings we chose and scored from public documents and audits, only five check the server from the user’s own software on their standard path. Four more ship a client check that path doesn’t use, and most of the rest leave the check to a gateway, the vendor or nobody we could find. We’d rethink where the check belongs if published client verifiers accepted stale, replayed or altered evidence.", "claims": [ { "id": "private-ai-verification-c50bc056", "claim": "TEE.fail made a machine outside any TEE, fitted with an NVIDIA 3060, pass the TDX and NVIDIA attestation checks of a modified vllm-proxy by pairing a forged TDX quote with a genuine H100 attestation relayed from a rented server, because NVIDIA does not bind an H100 to the identity of a specific VM.", "evidence_type": "research", "kind": "peer-reviewed-research", "section_url": "https://lugano.ai/research/private-ai-verification/#a-borrowed-h100", "sources": [ { "id": 1, "title": "TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition", "author": "Jalen Chuang, Alex Seto, Nicolas Berrios, Stephan van Schaik, Christina Garman, Daniel Genkin", "year": "2025", "url": "https://tee.fail/files/paper.pdf" } ] }, { "id": "private-ai-verification-8e23b442", "claim": "The TEE.fail authors state that, as far as they know, the attack has not been exploited in the wild, and give the venue as IEEE S&P 2026.", "evidence_type": "research", "kind": "researcher-statement", "section_url": "https://lugano.ai/research/private-ai-verification/#a-borrowed-h100", "sources": [ { "id": 2, "title": "TEE.fail project site", "author": "Jalen Chuang, Alex Seto, Nicolas Berrios, Stephan van Schaik, Christina Garman, Daniel Genkin (Georgia Tech, Purdue University, van Schaik LLC)", "year": "2025", "url": "https://tee.fail/" } ] }, { "id": "private-ai-verification-8dea0995", "claim": "On 5 January 2026 Judge Stein affirmed orders requiring OpenAI to produce a sample of 20 million de-identified consumer ChatGPT logs, noting that OpenAI has retained tens of billions of such logs in the ordinary course of its business.", "evidence_type": "official", "kind": "court-record", "section_url": "https://lugano.ai/research/private-ai-verification/#our-view", "sources": [ { "id": 3, "title": "Order affirming the 20-million-log production orders (MDL ECF 1021)", "author": "U.S. District Court, S.D.N.Y. (District Judge Sidney H. Stein)", "year": "2026", "url": "https://storage.courtlistener.com/recap/gov.uscourts.nysd.640396/gov.uscourts.nysd.640396.1021.0.pdf" } ] }, { "id": "private-ai-verification-37c21a2b", "claim": "NEAR AI documents the checks a verifier should run before sending, including DCAP quote verification, binding of a client nonce and signing address, replay of the event log against RTMR3, and comparison of the configuration measurement.", "evidence_type": "first-party", "kind": "first-party-documentation", "section_url": "https://lugano.ai/research/private-ai-verification/#the-scorecard", "sources": [ { "id": 4, "title": "NEAR AI Cloud documentation: model attestations", "author": "NEAR AI", "year": "2026", "url": "https://docs.near.ai/cloud/verification/cloud-api/model-attestations.md" } ] }, { "id": "private-ai-verification-b945ab79", "claim": "Brave states that its browser relies on Brave’s gateway to verify the enclave attestation today, and that it plans to move attestation checks into the browser.", "evidence_type": "first-party", "kind": "first-party-documentation", "section_url": "https://lugano.ai/research/private-ai-verification/#who-verifies", "sources": [ { "id": 7, "title": "Another Brave User-First AI Win: Leo adds End-to-end Encryption, Oblivious HTTP, and Verifiable Confidential Computing", "author": "Ali Shahin Shamsabadi, Brendan Eich, Darnell Andries, Jackson Egan (Brave)", "year": "2026", "url": "https://brave.com/blog/browser-ai-e2ee/" } ] }, { "id": "private-ai-verification-a72b1bd9", "claim": "In OpenAI’s Private Safety Processing, a cloud key vault releases OpenAI’s keys to the review runtime only when attestation evidence satisfies a release policy that OpenAI manages.", "evidence_type": "first-party", "kind": "first-party-documentation", "section_url": "https://lugano.ai/research/private-ai-verification/#who-verifies", "sources": [ { "id": 8, "title": "Private Safety Processing Overview (whitepaper)", "author": "OpenAI", "year": "2026", "url": "https://openaiassets.blob.core.windows.net/$web/pdf/c7284810-2252-462f-803e-075b0c95bccb/psp-whitepaper.pdf" } ] }, { "id": "private-ai-verification-966d8aad", "claim": "NCC Group describes a Private AI Compute design in which the client trusts a key meant to be hardcoded in its code or configuration while a central Google service validates the server’s attestation; Google’s September 2026 brief says servers receive a key only after passing attestation and devices verify that key before sending, and lists client-side attestation verification as a next step.", "evidence_type": "first-party", "kind": "independent-audit-and-first-party-documentation", "section_url": "https://lugano.ai/research/private-ai-verification/#who-verifies", "sources": [ { "id": 9, "title": "Private AI Compute in the Cloud: Assessment Overview", "author": "NCC Group", "year": "2025", "url": "https://www.nccgroup.com/media/cbuhuhuu/ncc_group_google_e025353p_report_2025-11-08_v14.pdf" }, { "id": 11, "title": "Google Private AI Compute: Enabled with Secure Server-Side Memory (technical brief)", "author": "Google", "year": "2026", "url": "https://services.google.com/fh/files/misc/private_ai_compute_technical_brief.pdf" } ] }, { "id": "private-ai-verification-e25c0f83", "claim": "Trail of Bits found that, for Google’s server-side memory feature, the Android client verifies the enclave’s attestation before sending key material, and reported an unresolved high-severity finding that hashes of response substrings reach non-confidential services.", "evidence_type": "research", "kind": "independent-audit", "section_url": "https://lugano.ai/research/private-ai-verification/#the-scorecard", "sources": [ { "id": 10, "title": "Google Private AI Compute, Secure Server-Side Memory: Security Assessment", "author": "Trail of Bits", "year": "2026", "url": "https://github.com/trailofbits/publications/blob/master/reviews/2026-09-google-secure-memory-securityreview.pdf" } ] }, { "id": "private-ai-verification-cd2be1dd", "claim": "NEAR AI’s documentation states that instances of the same model share one signing key, so a matching signer does not establish that the attested instance produced a given completion.", "evidence_type": "first-party", "kind": "first-party-documentation", "section_url": "https://lugano.ai/research/private-ai-verification/#where-the-check-runs", "sources": [ { "id": 4, "title": "NEAR AI Cloud documentation: model attestations", "author": "NEAR AI", "year": "2026", "url": "https://docs.near.ai/cloud/verification/cloud-api/model-attestations.md" } ] }, { "id": "private-ai-verification-6d38334d", "claim": "Venice’s documentation says a TEE-only request reaches the Venice API as plaintext and that developers should not rely on the server-side verified field alone.", "evidence_type": "first-party", "kind": "first-party-documentation", "section_url": "https://lugano.ai/research/private-ai-verification/#the-scorecard", "sources": [ { "id": 12, "title": "Venice documentation: TEE and E2EE models", "author": "Venice.ai", "year": "2026", "url": "https://docs.venice.ai/guides/features/tee-e2ee-models" } ] }, { "id": "private-ai-verification-da7a95e8", "claim": "Apple’s PCC release notes list as a known issue that verification of a certificate’s inclusion in the transparency log is not yet enforced.", "evidence_type": "first-party", "kind": "first-party-documentation", "section_url": "https://lugano.ai/research/private-ai-verification/#where-the-check-runs", "sources": [ { "id": 5, "title": "Private Cloud Compute Security Guide (Release transparency, Release notes, No privileged runtime access, Request handling, Management, Google Cloud roots of trust)", "author": "Apple", "year": "2026", "url": "https://security.apple.com/documentation/private-cloud-compute" } ] }, { "id": "private-ai-verification-cd9b137b", "claim": "TEE.fail recovered the Provisioning Certification Key of a 5th-generation Xeon in UpToDate status with a DDR5 interposer costing under $1,000 in secondhand parts, and forged quotes that Intel’s DCAP Quote Verification Library accepted.", "evidence_type": "research", "kind": "peer-reviewed-research", "section_url": "https://lugano.ai/research/private-ai-verification/#a-key-on-the-memory-bus", "sources": [ { "id": 1, "title": "TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition", "author": "Jalen Chuang, Alex Seto, Nicolas Berrios, Stephan van Schaik, Christina Garman, Daniel Genkin", "year": "2025", "url": "https://tee.fail/files/paper.pdf" } ] }, { "id": "private-ai-verification-fb979964", "claim": "WireTap extracted the attestation key of Intel SGX’s quoting enclave on DDR4 Xeon servers, at a cost its authors put under $1,000.", "evidence_type": "research", "kind": "first-party-research", "section_url": "https://lugano.ai/research/private-ai-verification/#a-key-on-the-memory-bus", "sources": [ { "id": 13, "title": "WireTap: Breaking Server SGX via DRAM Bus Interposition", "author": "Alex Seto, Oytun Kuday Duran, Samy Amer, Jalen Chuang, Stephan van Schaik, Daniel Genkin, Christina Garman (Purdue University, Georgia Tech)", "year": "2025", "url": "https://wiretap.fail" } ] }, { "id": "private-ai-verification-d17b2eb0", "claim": "Battering RAM, an interposer that can be built for less than $50, broke SEV-SNP attestation on fully patched DDR4 systems by replaying launch measurements.", "evidence_type": "research", "kind": "first-party-research", "section_url": "https://lugano.ai/research/private-ai-verification/#a-key-on-the-memory-bus", "sources": [ { "id": 14, "title": "Battering RAM: Low-Cost Interposer Attacks on Confidential Computing via Dynamic Memory Aliasing", "author": "Jesse De Meulemeester, David Oswald, Ingrid Verbauwhede, Jo Van Bulck", "year": "2025", "url": "https://batteringram.eu" } ] }, { "id": "private-ai-verification-59802866", "claim": "DDRop, an interposer with a bill of materials of about $159 per unit, let a rogue TDX virtual machine overwrite its launch measurement with a legitimate workload’s and pass remote attestation; Intel said the scenarios fall outside its standard threat model and that Platform Owner Endorsements are in development.", "evidence_type": "research", "kind": "first-party-research-and-vendor-statement", "section_url": "https://lugano.ai/research/private-ai-verification/#a-key-on-the-memory-bus", "sources": [ { "id": 15, "title": "DDRop: Active Memory Interposer Attacks on Confidential VMs by Dropping DDR5 Writes", "author": "Researchers at KU Leuven, ETH Zurich, Durham University and Google, including the Battering RAM authors", "year": "2026", "url": "https://ddropattack.eu" }, { "id": 19, "title": "DDRop: Physical Memory Interposer Research (Intel security announcement)", "author": "Intel", "year": "2026", "url": "https://www.intel.com/content/www/us/en/security-center/announcement/intel-security-announcement-2026-08-11-001.html" } ] }, { "id": "private-ai-verification-f24290fc", "claim": "Intel states that TEE.fail does not change its out-of-scope position on such physical attacks; an earlier Intel statement says WireTap and Battering RAM can reach SGX attestation keys and that Intel does not plan a CVE because its memory encryption gives limited confidentiality and no integrity or anti-replay protection against physical attackers.", "evidence_type": "first-party", "kind": "vendor-statement", "section_url": "https://lugano.ai/research/private-ai-verification/#a-key-on-the-memory-bus", "sources": [ { "id": 17, "title": "Intel Security Announcement 2025-10-28-001", "author": "Intel", "year": "2025", "url": "https://www.intel.com/content/www/us/en/security-center/announcement/intel-security-announcement-2025-10-28-001.html" }, { "id": 18, "title": "More Information on Encrypted Memory Frameworks for Intel Confidential Computing", "author": "Intel", "year": "2025", "url": "https://www.intel.com/content/www/us/en/developer/articles/news/more-information-encrypted-memory-frameworks.html" } ] }, { "id": "private-ai-verification-a4b214a0", "claim": "AMD’s SEV-SNP white paper puts on-line DRAM integrity attacks, such as attacking the DDR bus while a VM runs, out of scope, and the TEE.fail and Battering RAM researchers report that AMD treats interposer attacks as out of scope.", "evidence_type": "first-party", "kind": "vendor-statement-and-researcher-report", "section_url": "https://lugano.ai/research/private-ai-verification/#a-key-on-the-memory-bus", "sources": [ { "id": 55, "title": "AMD SEV-SNP: Strengthening VM Isolation with Integrity Protection and More (white paper 70366)", "author": "AMD", "year": "2020", "url": "https://docs.amd.com/v/u/en-US/SEV-SNP-strengthening-vm-isolation-with-integrity-protection-and-more" }, { "id": 2, "title": "TEE.fail project site", "author": "Jalen Chuang, Alex Seto, Nicolas Berrios, Stephan van Schaik, Christina Garman, Daniel Genkin (Georgia Tech, Purdue University, van Schaik LLC)", "year": "2025", "url": "https://tee.fail/" }, { "id": 14, "title": "Battering RAM: Low-Cost Interposer Attacks on Confidential Computing via Dynamic Memory Aliasing", "author": "Jesse De Meulemeester, David Oswald, Ingrid Verbauwhede, Jo Van Bulck", "year": "2025", "url": "https://batteringram.eu" } ] }, { "id": "private-ai-verification-b6746479", "claim": "Foreshadow extracted the attestation keys of Intel’s quoting enclave in 2018 and used them to pass code running outside SGX as a genuine enclave.", "evidence_type": "research", "kind": "first-party-research", "section_url": "https://lugano.ai/research/private-ai-verification/#memory-bus-attacks", "sources": [ { "id": 20, "title": "Foreshadow: Extracting the Keys to the Intel SGX Kingdom with Transient Out-of-Order Execution", "author": "Jo Van Bulck et al. (KU Leuven, Technion, University of Michigan, University of Adelaide, Data61)", "year": "2018", "url": "https://foreshadowattack.eu/" } ] }, { "id": "private-ai-verification-1c597905", "claim": "Storm-0558 used a Microsoft consumer signing key created in 2016, with a flaw in token validation, to compromise the mailboxes of 22 organizations and over 500 individuals, and Microsoft did not know how or when the key was obtained as of the CSRB report.", "evidence_type": "research", "kind": "independent-review", "section_url": "https://lugano.ai/research/private-ai-verification/#memory-bus-attacks", "sources": [ { "id": 21, "title": "Review of the Summer 2023 Microsoft Exchange Online Intrusion", "author": "U.S. Cyber Safety Review Board", "year": "2024", "url": "https://www.cisa.gov/sites/default/files/2024-03/CSRB%20Review%20of%20the%20Summer%202023%20MEO%20Intrusion%20Final_508c.pdf" } ] }, { "id": "private-ai-verification-0f606e98", "claim": "Trail of Bits recommended chain-of-custody documentation for every enrolled CPU, so Meta can verify each is in its custody and exclude CPUs that may have faced key-extraction attacks, and noted in a separate recommendation that the SEV-SNP threat model does not defend against advanced physical attacks.", "evidence_type": "research", "kind": "independent-audit", "section_url": "https://lugano.ai/research/private-ai-verification/#a-key-on-the-memory-bus", "sources": [ { "id": 6, "title": "Meta WhatsApp Private Processing: Security Assessment with Fix Review", "author": "Trail of Bits", "year": "2025", "url": "https://github.com/trailofbits/publications/blob/master/reviews/2025-08-meta-whatsapp-privateprocessing-securityreview.pdf" } ] }, { "id": "private-ai-verification-02f525ed", "claim": "Five of the 17 offerings scored check the first component that can read the prompt from the user’s own software on their standard path: Apple PCC, WhatsApp Private Processing, Privatemode (SDK or proxy), Maple and Tinfoil (SDK).", "evidence_type": "our-analysis", "kind": "analysis-of-first-party-documentation", "section_url": "https://lugano.ai/research/private-ai-verification/#where-the-check-runs", "sources": [ { "id": 5, "title": "Private Cloud Compute Security Guide (Release transparency, Release notes, No privileged runtime access, Request handling, Management, Google Cloud roots of trust)", "author": "Apple", "year": "2026", "url": "https://security.apple.com/documentation/private-cloud-compute" }, { "id": 6, "title": "Meta WhatsApp Private Processing: Security Assessment with Fix Review", "author": "Trail of Bits", "year": "2025", "url": "https://github.com/trailofbits/publications/blob/master/reviews/2025-08-meta-whatsapp-privateprocessing-securityreview.pdf" }, { "id": 34, "title": "Privatemode documentation: API quickstart", "author": "Edgeless Systems", "year": "2026", "url": "https://docs.privatemode.ai/getting-started/api/" }, { "id": 35, "title": "Privatemode documentation: attestation overview", "author": "Edgeless Systems", "year": "2026", "url": "https://docs.privatemode.ai/security/attestation/overview/" }, { "id": 56, "title": "How Maple Works: Private AI You Can Check", "author": "Maple Privacy Labs", "year": "2026", "url": "https://maple.ai/proof" }, { "id": 50, "title": "Tinfoil documentation: quickstart", "author": "Tinfoil", "year": "2026", "url": "https://docs.tinfoil.sh/quickstart" }, { "id": 49, "title": "Tinfoil documentation: verification in Tinfoil", "author": "Tinfoil", "year": "2026", "url": "https://docs.tinfoil.sh/verification/verification-in-tinfoil.md" } ] }, { "id": "private-ai-verification-3b5ba8fd", "claim": "NEAR AI’s quickstart uses curl and the standard OpenAI client with no attestation check, while NEAR’s own SDKs at version 0.2.1 verify gateway evidence before sending and stop the request when a required check fails.", "evidence_type": "first-party", "kind": "first-party-documentation", "section_url": "https://lugano.ai/research/private-ai-verification/#the-scorecard", "sources": [ { "id": 37, "title": "NEAR AI Cloud documentation: quickstart", "author": "NEAR AI", "year": "2026", "url": "https://docs.near.ai/cloud/quickstart.md" }, { "id": 38, "title": "NEAR AI Cloud documentation: inference SDK", "author": "NEAR AI", "year": "2026", "url": "https://docs.near.ai/cloud/inference-sdk/index.md" }, { "id": 60, "title": "NEAR AI Inference SDK (README and v0.2.1 release)", "author": "NEAR AI", "year": "2026", "url": "https://github.com/nearai/inference-sdk" } ] }, { "id": "private-ai-verification-b42346b1", "claim": "Phala’s quickstart uses the standard OpenAI client, and Phala states that ordinary clients do not verify its gateway, which terminates TLS and processes plaintext inside a TDX enclave; it offers the ACI verifier SDK and Private AI Proxy for client-side checks.", "evidence_type": "first-party", "kind": "first-party-documentation", "section_url": "https://lugano.ai/research/private-ai-verification/#the-scorecard", "sources": [ { "id": 65, "title": "Phala Cloud confidential AI documentation: on-demand API", "author": "Phala Network", "year": "2026", "url": "https://docs.phala.com/phala-cloud/confidential-ai/confidential-model/confidential-ai-api.md" }, { "id": 44, "title": "Phala Cloud confidential AI documentation: providers", "author": "Phala Network", "year": "2026", "url": "https://docs.phala.com/phala-cloud/confidential-ai/confidential-model/providers.md" }, { "id": 42, "title": "Phala Cloud confidential AI documentation: trust boundary", "author": "Phala Network", "year": "2026", "url": "https://docs.phala.com/phala-cloud/confidential-ai/confidential-model/trust-boundary.md" }, { "id": 41, "title": "Phala Cloud confidential AI documentation: verify attestation", "author": "Phala Network", "year": "2026", "url": "https://docs.phala.com/phala-cloud/confidential-ai/verify/verify-attestation.md" } ] }, { "id": "private-ai-verification-4c7a7014", "claim": "OpenAI’s Private Safety Processing whitepaper states that the runtime’s storage-disabled inference path does not provide an inference-wide Zero Operator Access guarantee.", "evidence_type": "first-party", "kind": "first-party-documentation", "section_url": "https://lugano.ai/research/private-ai-verification/#the-scorecard", "sources": [ { "id": 8, "title": "Private Safety Processing Overview (whitepaper)", "author": "OpenAI", "year": "2026", "url": "https://openaiassets.blob.core.windows.net/$web/pdf/c7284810-2252-462f-803e-075b0c95bccb/psp-whitepaper.pdf" } ] }, { "id": "private-ai-verification-d7b169fa", "claim": "OpenAI announced Private Inference at DevDay on 29 September 2026 as a preview coming that fall; neither the recap, the product page nor the safety-processing whitepaper says who verifies the attestation.", "evidence_type": "first-party", "kind": "first-party-documentation", "section_url": "https://lugano.ai/research/private-ai-verification/#the-scorecard", "sources": [ { "id": 28, "title": "DevDay 2026 Recap", "author": "OpenAI", "year": "2026", "url": "https://openai.com/index/devday-2026-recap/" }, { "id": 29, "title": "Private Intelligence", "author": "OpenAI", "year": "2026", "url": "https://openai.com/business/private-intelligence/" }, { "id": 8, "title": "Private Safety Processing Overview (whitepaper)", "author": "OpenAI", "year": "2026", "url": "https://openaiassets.blob.core.windows.net/$web/pdf/c7284810-2252-462f-803e-075b0c95bccb/psp-whitepaper.pdf" } ] }, { "id": "private-ai-verification-5bcf804a", "claim": "Meta’s Private Processing whitepaper states that optional web-search queries of up to 100 characters leave the TEE in plaintext, and that its transparency log is a simple third-party log rather than a Merkle tree.", "evidence_type": "first-party", "kind": "first-party-documentation", "section_url": "https://lugano.ai/research/private-ai-verification/#the-scorecard", "sources": [ { "id": 25, "title": "Private Processing technical whitepaper (V3)", "author": "Meta", "year": "2026", "url": "https://ai.meta.com/static-resource/private-processing-technical-whitepaper" } ] }, { "id": "private-ai-verification-f1eb994f", "claim": "Privatemode’s proxyless API provides no client-side remote attestation, and users trust its zero-retention policy without technical enforcement.", "evidence_type": "first-party", "kind": "first-party-documentation", "section_url": "https://lugano.ai/research/private-ai-verification/#the-scorecard", "sources": [ { "id": 33, "title": "Privatemode documentation: proxyless API", "author": "Edgeless Systems", "year": "2026", "url": "https://docs.privatemode.ai/api/proxyless-api/" } ] }, { "id": "private-ai-verification-fe065bc0", "claim": "Tinfoil’s SDK stops all connections when Sigstore-published measurements do not match the enclave attestation, while a direct connection to its OpenAI-compatible endpoint skips that connection-time check.", "evidence_type": "first-party", "kind": "first-party-documentation", "section_url": "https://lugano.ai/research/private-ai-verification/#the-scorecard", "sources": [ { "id": 49, "title": "Tinfoil documentation: verification in Tinfoil", "author": "Tinfoil", "year": "2026", "url": "https://docs.tinfoil.sh/verification/verification-in-tinfoil.md" }, { "id": 50, "title": "Tinfoil documentation: quickstart", "author": "Tinfoil", "year": "2026", "url": "https://docs.tinfoil.sh/quickstart" } ] }, { "id": "private-ai-verification-08a8ea92", "claim": "TEE.fail’s DDR5 setup also extracted OpenSSL ECDSA signing keys from a VM protected by AMD SEV-SNP with ciphertext hiding enabled.", "evidence_type": "research", "kind": "research-preprint", "section_url": "https://lugano.ai/research/private-ai-verification/#memory-bus-attacks", "sources": [ { "id": 1, "title": "TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition", "author": "Jalen Chuang, Alex Seto, Nicolas Berrios, Stephan van Schaik, Christina Garman, Daniel Genkin", "year": "2025", "url": "https://tee.fail/files/paper.pdf" } ] }, { "id": "private-ai-verification-0d51db47", "claim": "A version of the TEE.fail paper, retitled “Transparent Domain eXtensions: Breaking Intel TEE Implementations via DDR5 Memory Bus Interposition”, appeared at IEEE S&P 2026.", "evidence_type": "research", "kind": "conference-program", "section_url": "https://lugano.ai/research/private-ai-verification/#memory-bus-attacks", "sources": [ { "id": 64, "title": "IEEE Symposium on Security and Privacy 2026: Accepted Papers", "author": "IEEE Computer Society Technical Community on Security and Privacy", "year": "2026", "url": "https://sp2026.ieee-security.org/accepted-papers.html" } ] }, { "id": "private-ai-verification-edffdbd6", "claim": "On OpenAI’s zero-retention API with Private Safety Processing, safety classifiers run during the ordinary API request, Private Inference does not automatically cover that request, and attestation is checked only when a cloud key vault releases keys to the downstream review runtime.", "evidence_type": "first-party", "kind": "first-party-documentation", "section_url": "https://lugano.ai/research/private-ai-verification/#the-scorecard", "sources": [ { "id": 8, "title": "Private Safety Processing Overview (whitepaper)", "author": "OpenAI", "year": "2026", "url": "https://openaiassets.blob.core.windows.net/$web/pdf/c7284810-2252-462f-803e-075b0c95bccb/psp-whitepaper.pdf" } ] }, { "id": "private-ai-verification-a42e159a", "claim": "A Venice TEE-only request reaches Venice’s own proxy in plaintext before the partner enclave run by NEAR AI Cloud or Phala Network, and Venice says TEE users still trust it not to keep data in transit; in E2EE mode Venice documents a client-side flow that checks the attestation and encrypts to the enclave’s key before sending, though its reference code relies on the server’s verified flag and a nonce match.", "evidence_type": "first-party", "kind": "first-party-documentation", "section_url": "https://lugano.ai/research/private-ai-verification/#the-scorecard", "sources": [ { "id": 12, "title": "Venice documentation: TEE and E2EE models", "author": "Venice.ai", "year": "2026", "url": "https://docs.venice.ai/guides/features/tee-e2ee-models" }, { "id": 61, "title": "Venice Launches End-to-End Encrypted AI", "author": "Venice.ai", "year": "2026", "url": "https://venice.ai/blog/venice-launches-end-to-end-encrypted-ai" } ] }, { "id": "private-ai-verification-b14a42a4", "claim": "Nillion’s quickstart sends prompts with no attestation check, while Nillion’s n8n node checks the enclave’s AMD SEV-SNP attestation before sending but still sends the prompt when the check fails.", "evidence_type": "first-party", "kind": "first-party-documentation", "section_url": "https://lugano.ai/research/private-ai-verification/#the-scorecard", "sources": [ { "id": 63, "title": "nilAI documentation: quickstart", "author": "Nillion", "year": "2026", "url": "https://docs.nillion.com/blind-computer/build/llms/quickstart" }, { "id": 62, "title": "n8n-nodes-nilai", "author": "Nillion", "year": "2026", "url": "https://github.com/NillionNetwork/n8n-nodes-nilai/tree/f5dac9444bc9e573d552b1f9ce5b5981a987b014" } ] }, { "id": "private-ai-verification-be32b727", "claim": "Maple’s app checks the Nitro enclave’s attestation before sending anything and sends nothing if a check fails; Maple’s enclave then verifies the model’s enclave, which its backend routes to Tinfoil or Privatemode.", "evidence_type": "first-party", "kind": "first-party-documentation", "section_url": "https://lugano.ai/research/private-ai-verification/#the-scorecard", "sources": [ { "id": 56, "title": "How Maple Works: Private AI You Can Check", "author": "Maple Privacy Labs", "year": "2026", "url": "https://maple.ai/proof" }, { "id": 57, "title": "Maple monorepo: OpenSecret provider registry (services/opensecret/src/provider_registry.rs)", "author": "Maple Privacy Labs", "year": "2026", "url": "https://github.com/MaplePrivacyLabs/Maple/blob/b5f66e0af222eaf8f873cb873e3bf67ca2b475c3/services/opensecret/src/provider_registry.rs" } ] }, { "id": "private-ai-verification-9f8c183d", "claim": "Google’s September 2026 brief says Private AI Compute servers receive a key only after passing attestation and that clients verify this key before transmitting data.", "evidence_type": "first-party", "kind": "first-party-documentation", "section_url": "https://lugano.ai/research/private-ai-verification/#who-verifies", "sources": [ { "id": 11, "title": "Google Private AI Compute: Enabled with Secure Server-Side Memory (technical brief)", "author": "Google", "year": "2026", "url": "https://services.google.com/fh/files/misc/private_ai_compute_technical_brief.pdf" } ] }, { "id": "private-ai-verification-b2844126", "claim": "NEAR AI Cloud’s catalog includes Incognito models from OpenAI, Anthropic, Google and others that run on the providers’ infrastructure outside any TEE.", "evidence_type": "first-party", "kind": "first-party-documentation", "section_url": "https://lugano.ai/research/private-ai-verification/#the-scorecard", "sources": [ { "id": 58, "title": "NEAR AI Cloud documentation: available models", "author": "NEAR AI", "year": "2026", "url": "https://docs.near.ai/cloud/models.md" } ] } ] }, { "slug": "private-information", "title": "Can AI work with sensitive information without exposing it?", "url": "https://lugano.ai/research/private-information/", "published": "2026-11-03", "revised": "2026-11-04", "in_short": "Tighter limits on search, memory and tools can cut disclosure, and they can also drop a fact the correct answer depends on. So decide what to send task by task, and score leaked facts and complete answers together. We’ve designed but not run that test, and if tighter handling doesn’t cut disclosure, or works only by blocking correct answers, we’d change our position.", "claims": [ { "id": "private-information-10b94b94", "claim": "The NIST Privacy Framework frames privacy as an enterprise risk-management and privacy-engineering problem, while NIST SP 800-207 focuses zero-trust architecture on resources rather than implicit trust based solely on location or ownership.", "evidence_type": "official", "kind": "official-guidance", "section_url": "https://lugano.ai/research/private-information/#five-places-information-changes-hands", "sources": [ { "id": 6, "title": "NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management, Version 1.0", "author": "National Institute of Standards and Technology", "year": "2020", "url": "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf" }, { "id": 7, "title": "SP 800-207: Zero Trust Architecture", "author": "National Institute of Standards and Technology", "year": "2020", "url": "https://csrc.nist.gov/pubs/sp/800/207/final" } ] }, { "id": "private-information-bd68bac2", "claim": "RFC 6973 distinguishes privacy threats such as disclosure, correlation, identification and secondary use, and treats data minimization as one mitigation among others.", "evidence_type": "official", "kind": "official-guidance", "section_url": "https://lugano.ai/research/private-information/#disclosure-is-not-retention", "sources": [ { "id": 10, "title": "RFC 6973: Privacy Considerations for Internet Protocols", "author": "Alissa Cooper et al., Internet Architecture Board", "year": "2013", "url": "https://www.rfc-editor.org/rfc/rfc6973.html" } ] }, { "id": "private-information-d9a99f35", "claim": "The MCP 2026-07-28 specification’s key principles say hosts must obtain explicit user consent before exposing user data to servers, and the specification says MCP itself cannot enforce its security and privacy principles at the protocol level.", "evidence_type": "official", "kind": "official-specification", "section_url": "https://lugano.ai/research/private-information/#disclosure-is-not-retention", "sources": [ { "id": 8, "title": "Model Context Protocol Core Specification (2026-07-28)", "author": "Model Context Protocol project", "year": "2026", "url": "https://modelcontextprotocol.io/specification/2026-07-28" } ] }, { "id": "private-information-cf2118af", "claim": "Carlini et al. (2019) introduced an exposure metric for unintended memorization and reported that their differentially private training experiments eliminated the measured issue with a utility cost.", "evidence_type": "research", "kind": "reported", "section_url": "https://lugano.ai/research/private-information/#what-the-literature-makes-hard-to-ignore", "sources": [ { "id": 1, "title": "The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks", "author": "Nicholas Carlini et al.", "year": "2019", "url": "https://www.usenix.org/conference/usenixsecurity19/presentation/carlini" } ] }, { "id": "private-information-290219cf", "claim": "Carlini et al. (2021) demonstrated black-box extraction of hundreds of verbatim GPT-2 training sequences and found that some worst-case training examples were memorized although training loss was not noticeably lower than test loss on average.", "evidence_type": "research", "kind": "reported", "section_url": "https://lugano.ai/research/private-information/#what-the-literature-makes-hard-to-ignore", "sources": [ { "id": 2, "title": "Extracting Training Data from Large Language Models", "author": "Nicholas Carlini et al.", "year": "2021", "url": "https://www.usenix.org/system/files/sec21-carlini-extracting.pdf" } ] }, { "id": "private-information-821ca5f4", "claim": "Peng et al.’s arXiv v2 preprint reports a poisoned-fine-tuning backdoor that can cause RAG document extraction in the authors’ experimental settings; it is not a prevalence finding.", "evidence_type": "research", "kind": "reported-preprint", "section_url": "https://lugano.ai/research/private-information/#what-the-literature-makes-hard-to-ignore", "sources": [ { "id": 4, "title": "Data Extraction Attacks in Retrieval-Augmented Generation via Backdoors", "author": "Yuefeng Peng et al.", "year": "2025", "url": "https://arxiv.org/abs/2411.01705v2" } ] }, { "id": "private-information-47525a8f", "claim": "Greshake et al. demonstrate that strategically placed retrieved text can influence LLM-integrated application behavior and API calls.", "evidence_type": "research", "kind": "reported", "section_url": "https://lugano.ai/research/private-information/#what-the-literature-makes-hard-to-ignore", "sources": [ { "id": 3, "title": "Not what you’ve signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection", "author": "Kai Greshake et al.", "year": "2023", "url": "https://arxiv.org/abs/2302.12173v2" } ] }, { "id": "private-information-27687efe", "claim": "CaMeL extracts control and data flow from the trusted query so untrusted retrieved data cannot alter program flow, and uses capabilities to block unauthorized data flows, under its stated assumptions, with a reported utility and security comparison in AgentDojo.", "evidence_type": "research", "kind": "reported", "section_url": "https://lugano.ai/research/private-information/#what-the-literature-makes-hard-to-ignore", "sources": [ { "id": 5, "title": "Defeating Prompt Injections by Design (arXiv v2, 24 June 2025)", "author": "Edoardo Debenedetti et al.", "year": "2025", "url": "https://arxiv.org/abs/2503.18813v2" } ] }, { "id": "private-information-59c39af0", "claim": "Lugano’s local static review of MCP server packages records third-party endpoints in package code that its documentation check did not find; these are static markers, not runtime requests, and the sample is not download-ranked.", "evidence_type": "our-study", "kind": "local-static-study", "section_url": "https://lugano.ai/research/private-information/#an-answer-conditioned-on-the-route", "sources": [ { "id": 9, "title": "Static source observations from 50 sampled MCP server packages", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/private-information/#source-9" } ] }, { "id": "private-information-51bb8955", "claim": "Carlini et al. (2021) show GPT-2 reproducing a real individual’s full name, email address, phone number, fax number and physical address (Figure 1); the details had been shared online as contact information for a software project and appear in just a few documents, and the authors masked them and obtained the individual’s permission.", "evidence_type": "research", "kind": "reported", "section_url": "https://lugano.ai/research/private-information/#what-the-literature-makes-hard-to-ignore", "sources": [ { "id": 2, "title": "Extracting Training Data from Large Language Models", "author": "Nicholas Carlini et al.", "year": "2021", "url": "https://www.usenix.org/system/files/sec21-carlini-extracting.pdf" } ] } ] }, { "slug": "private-verification", "title": "What can we verify without recording someone’s private work?", "url": "https://lugano.ai/research/private-verification/", "published": "2026-11-03", "revised": "2026-11-04", "in_short": "Minimizing evidence trades what a reviewer can still decide against what the record gives away, and both sides can be counted. A review that scores a confident signature check as detection hides exactly the cases where the evidence can’t decide. We expect the first receipts to hold up in a contested audit to come from one observer, cut to one decision and sent to one named reviewer.", "claims": [ { "id": "private-verification-b4cbefa8", "claim": "FIPS 186-5 describes digital signatures as mechanisms for detecting unauthorized modification of signed data and authenticating the claimed signatory of that data.", "evidence_type": "official", "kind": "official-standard", "section_url": "https://lugano.ai/research/private-verification/#what-a-signature-binds", "sources": [ { "id": 1, "title": "FIPS 186-5: Digital Signature Standard (DSS)", "author": "National Institute of Standards and Technology", "year": "2023", "url": "https://csrc.nist.gov/pubs/fips/186-5/final" } ] }, { "id": "private-verification-53307386", "claim": "RFC 9334 distinguishes an Attester, a Verifier that appraises evidence against reference values and appraisal policy, and a Relying Party that uses attestation results for application-specific decisions, with freshness as an architectural choice.", "evidence_type": "official", "kind": "official-architecture", "section_url": "https://lugano.ai/research/private-verification/#attestation-is-not-action-observation", "sources": [ { "id": 2, "title": "RFC 9334: Remote ATtestation procedureS (RATS) Architecture", "author": "Henk Birkholz et al.", "year": "2023", "url": "https://www.rfc-editor.org/rfc/rfc9334.html" } ] }, { "id": "private-verification-e3e98ed8", "claim": "RFC 6973 identifies correlation, identification, secondary use and disclosure as distinct privacy threats relevant to protocol design.", "evidence_type": "official", "kind": "official-guidance", "section_url": "https://lugano.ai/research/private-verification/#evidence-is-a-disclosure-surface", "sources": [ { "id": 3, "title": "RFC 6973: Privacy Considerations for Internet Protocols", "author": "Alissa Cooper et al., Internet Architecture Board", "year": "2013", "url": "https://www.rfc-editor.org/rfc/rfc6973.html" } ] }, { "id": "private-verification-5e85d6f2", "claim": "Historical AAR v0.1 material: The local AAR v0.1 document is a proposed draft, not a deployed runtime, public log or attestation service, and its illustrative receipt includes claimed metadata such as hosts, counts, hashes and a retained field that can disclose operational information.", "evidence_type": "our-design", "kind": "local-draft", "section_url": "https://lugano.ai/research/private-verification/#evidence-is-a-disclosure-surface", "sources": [ { "id": 5, "title": "Historical v0.1 — Attested Agent Receipt (AAR) v0.1", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/private-verification/#source-5" } ] }, { "id": "private-verification-f6ecd61d", "claim": "The MCP 2026-07-28 specification says MCP itself cannot enforce its security principles at the protocol level, leaving them to implementors.", "evidence_type": "official", "kind": "official-specification", "section_url": "https://lugano.ai/research/private-verification/#attestation-is-not-action-observation", "sources": [ { "id": 4, "title": "Model Context Protocol Core Specification (2026-07-28)", "author": "Model Context Protocol project", "year": "2026", "url": "https://modelcontextprotocol.io/specification/2026-07-28" } ] }, { "id": "private-verification-c42e7835", "claim": "The draft specifies a ULID run identifier; ULIDs embed millisecond time. Run identifiers join copies of a task, while reused key identifiers can link different runs.", "evidence_type": "our-analysis", "kind": "official-and-local-analysis", "section_url": "https://lugano.ai/research/private-verification/#evidence-is-a-disclosure-surface", "sources": [ { "id": 3, "title": "RFC 6973: Privacy Considerations for Internet Protocols", "author": "Alissa Cooper et al., Internet Architecture Board", "year": "2013", "url": "https://www.rfc-editor.org/rfc/rfc6973.html" }, { "id": 5, "title": "Historical v0.1 — Attested Agent Receipt (AAR) v0.1", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/private-verification/#source-5" }, { "id": 6, "title": "ULID specification (reviewed 2026)", "author": "ULID maintainers", "year": "2026", "url": "https://github.com/ulid/spec" } ] }, { "id": "private-verification-80e4fe17", "claim": "An equally minimized conventional signed export is an untested adoption alternative. The proposed pilot compares richer and minimized evidence from the same observer and does not identify a format-specific AAR advantage.", "evidence_type": "our-design", "kind": "research-position", "section_url": "https://lugano.ai/research/private-verification/#the-verification-boundary", "sources": [] }, { "id": "private-verification-36c590e1", "claim": "Signed Agent Receipt v0.2 is a bounded offline implementation with a fixed input schema, externally selected issuer and log keys, domain-separated Ed25519 signing bytes, and Merkle membership checks. A pass establishes only that the statement matches the schema, that the selected issuer and log keys signed the statement and tree head, and that the statement is a member of that signed root; it does not establish event truth, completeness, hardware attestation, retention, time, or public-log history. Inventory lists may be empty.", "evidence_type": "our-design", "kind": "local-reference-implementation", "section_url": "https://lugano.ai/research/private-verification/#what-a-signature-binds", "sources": [ { "id": 7, "title": "Signed Agent Receipt Reference Profile v0.2", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/private-verification/#source-7" }, { "id": 8, "title": "Signed Agent Receipt v0.2: README and checker guide", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/private-verification/#source-8" } ] } ] }, { "slug": "prompt-injection", "title": "Can agents read hostile information without following its instructions?", "url": "https://lugano.ai/research/prompt-injection/", "published": "2026-11-03", "revised": "2026-11-04", "in_short": "We’d let a source fill the fields and branches the trusted task names, and never add a step, a destination or a permission. Defense scores must count false blocks beside stopped attacks. Our unrun test would sink this if plain source marking does as well for less, or an adaptive attacker slips a forbidden step through.", "claims": [ { "id": "prompt-injection-89f340bc", "claim": "Greshake et al. demonstrate that prompt text strategically placed in data likely to be retrieved can influence LLM-integrated application behavior without the attacker having a direct interface to the model, including in tests against Bing Chat.", "evidence_type": "research", "kind": "reported-preprint", "section_url": "https://lugano.ai/research/prompt-injection/#the-document-that-answers-back", "sources": [ { "id": 1, "title": "Not What You’ve Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection (arXiv preprint)", "author": "Kai Greshake et al.", "year": "2023", "url": "https://arxiv.org/abs/2302.12173v2" } ] }, { "id": "prompt-injection-b6e37d30", "claim": "Zverev et al. formalize instruction-data separation, introduce the SEP dataset, and report low separation in their evaluated models, with canonical mitigations either failing to substantially improve it or reducing utility in their setting; the authors flag GPT-3.5 and GPT-4 after prompt engineering as an exception and caution that GPT-4 helped create the dataset.", "evidence_type": "research", "kind": "reported", "section_url": "https://lugano.ai/research/prompt-injection/#one-language-channel-two-roles", "sources": [ { "id": 2, "title": "Can LLMs Separate Instructions From Data? And What Do We Even Mean By That?", "author": "Egor Zverev et al.", "year": "2025", "url": "https://arxiv.org/abs/2403.06833v3" } ] }, { "id": "prompt-injection-9335e4ab", "claim": "BIPIA’s authors report vulnerability in the models they evaluated and identify difficulty separating informational context from actionable instructions as a contributing factor.", "evidence_type": "research", "kind": "reported", "section_url": "https://lugano.ai/research/prompt-injection/#one-language-channel-two-roles", "sources": [ { "id": 3, "title": "Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models", "author": "Jingwei Yi et al.", "year": "2025", "url": "https://arxiv.org/abs/2312.14197v4" } ] }, { "id": "prompt-injection-4ef479c3", "claim": "The Instruction Hierarchy arXiv preprint trains a GPT-3.5 model to prioritize system, user, and third-party instructions by privilege and reports robustness and over-refusal outcomes in that evaluated setting.", "evidence_type": "research", "kind": "reported-preprint", "section_url": "https://lugano.ai/research/prompt-injection/#model-level-improvement-is-not-a-parser", "sources": [ { "id": 4, "title": "The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions (arXiv preprint)", "author": "Eric Wallace et al.", "year": "2024", "url": "https://arxiv.org/abs/2404.13208v1" } ] }, { "id": "prompt-injection-97e0b898", "claim": "AgentDojo reports 97 tasks and 629 security test cases in a stateful tool environment and notes that strong models can fail ordinary tasks even without attack.", "evidence_type": "research", "kind": "reported", "section_url": "https://lugano.ai/research/prompt-injection/#why-the-scores-do-not-settle-it", "sources": [ { "id": 5, "title": "AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents", "author": "Edoardo Debenedetti et al.", "year": "2024", "url": "https://proceedings.neurips.cc/paper_files/paper/2024/file/97091a5177d8dc64b1da8bf3e1f6fb54-Paper-Datasets_and_Benchmarks_Track.pdf" } ] }, { "id": "prompt-injection-6ea9f2c2", "claim": "CaMeL’s 24 June 2025 arXiv v2 reports 77% versus 84% AgentDojo utility under its stated property; it assumes a trusted prompt and uncompromised memory in its main model, excludes answer-only corruption, and discusses side channels.", "evidence_type": "research", "kind": "reported-preprint", "section_url": "https://lugano.ai/research/prompt-injection/#where-a-separation-can-be-enforced", "sources": [ { "id": 6, "title": "Defeating Prompt Injections by Design (arXiv v2, 24 June 2025)", "author": "Edoardo Debenedetti et al.", "year": "2025", "url": "https://arxiv.org/abs/2503.18813v2" } ] }, { "id": "prompt-injection-6943aa8b", "claim": "Bhagwatkar et al. characterize their v2 firewall results as perfect security with high utility across four public benchmarks, but the body reports nonzero Sanitizer ASR in ASB, no utility metric for InjecAgent, and a defense-aware Stage 3 result in AgentDojo’s Slack suite. These measurements are setup-specific.", "evidence_type": "research", "kind": "reported-preprint", "section_url": "https://lugano.ai/research/prompt-injection/#why-the-scores-do-not-settle-it", "sources": [ { "id": 7, "title": "Indirect Prompt Injections: Are Firewalls All You Need, or Stronger Benchmarks? (arXiv v2, 23 March 2026)", "author": "Rishika Bhagwatkar et al.", "year": "2026", "url": "https://arxiv.org/abs/2510.05244v2" } ] }, { "id": "prompt-injection-3979d5a4", "claim": "Hofer et al. evaluate automated prompt injections across 80 task pairs in four AgentDojo domains; their selected 20-pair transfer ablation reports very low measured transfer to GPT-5 for GCG suffixes optimized on Qwen3-4B, with only one source model and no general zero-transfer claim.", "evidence_type": "research", "kind": "reported-preprint", "section_url": "https://lugano.ai/research/prompt-injection/#why-the-scores-do-not-settle-it", "sources": [ { "id": 8, "title": "Assessing Automated Prompt Injection Attacks in Agentic Environments", "author": "David Hofer, Edoardo Debenedetti, and Florian Tramèr", "year": "2026", "url": "https://arxiv.org/abs/2606.10525v1" } ] }, { "id": "prompt-injection-884fdffc", "claim": "The MCP 2026-07-28 core specification says tools represent arbitrary code execution, treats tool behavior descriptions and annotations as untrusted unless from a trusted server, and states that MCP cannot itself enforce its safety principles at the protocol level.", "evidence_type": "official", "kind": "official-specification", "section_url": "https://lugano.ai/research/prompt-injection/#the-paths-the-text-takes", "sources": [ { "id": 9, "title": "Model Context Protocol Core Specification (2026-07-28)", "author": "Model Context Protocol project", "year": "2026", "url": "https://modelcontextprotocol.io/specification/2026-07-28" } ] }, { "id": "prompt-injection-f67be14d", "claim": "Wu, Cecchetti, and Xiao’s arXiv preprint proposes a labeled information-flow-control pipeline with structured planning and a security monitor; its formal and empirical claims depend on trusted facilities, secure channels, its source model, and evaluated configurations.", "evidence_type": "research", "kind": "reported-preprint", "section_url": "https://lugano.ai/research/prompt-injection/#where-a-separation-can-be-enforced", "sources": [ { "id": 10, "title": "System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspective (arXiv preprint)", "author": "Fangzhou Wu, Ethan Cecchetti, and Chaowei Xiao", "year": "2024", "url": "https://arxiv.org/abs/2409.19091v2" } ] }, { "id": "prompt-injection-0c999fc0", "claim": "Instruction-hierarchy training changes model weights; source or API-role markup on a model trained otherwise does not reproduce that intervention and tests presentation only.", "evidence_type": "our-analysis", "kind": "analysis", "section_url": "https://lugano.ai/research/prompt-injection/#model-level-improvement-is-not-a-parser", "sources": [ { "id": 4, "title": "The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions (arXiv preprint)", "author": "Eric Wallace et al.", "year": "2024", "url": "https://arxiv.org/abs/2404.13208v1" } ] }, { "id": "prompt-injection-5b43b465", "claim": "The CaMeL code-release README warns that its research interpreter likely contains bugs and might not be fully secure; a paper’s property does not establish implementation correctness.", "evidence_type": "research", "kind": "author-code-release", "section_url": "https://lugano.ai/research/prompt-injection/#where-a-separation-can-be-enforced", "sources": [ { "id": 11, "title": "CaMeL research artifact — README", "author": "CaMeL authors / Google Research", "year": "2025", "url": "https://github.com/google-research/camel-prompt-injection/blob/f083b6b396399d3b3c7f2ddaf613a5945eaf32d8/README.md" } ] }, { "id": "prompt-injection-29d082e3", "claim": "The four-path analysis applies established information-flow controls and makes no new defense, formal-proof, or empirical superiority claim.", "evidence_type": "our-analysis", "kind": "local-scope", "section_url": "https://lugano.ai/research/prompt-injection/#what-an-answer-would-mean", "sources": [] }, { "id": "prompt-injection-35475a60", "claim": "OpenAI’s March 2026 engineering account describes persuasive, social-engineering-style injections and controls that constrain consequences even when some attacks succeed.", "evidence_type": "first-party", "kind": "vendor-engineering-account", "section_url": "https://lugano.ai/research/prompt-injection/#where-a-separation-can-be-enforced", "sources": [ { "id": 12, "title": "Designing AI agents to resist prompt injection", "author": "Thomas Shadwell and Adrian Spânu, OpenAI", "year": "2026", "url": "https://openai.com/index/designing-agents-to-resist-prompt-injection/" } ] } ] }, { "slug": "proposed-studies", "title": "What would prove us wrong?", "url": "https://lugano.ai/research/proposed-studies/", "published": "2026-11-03", "revised": "2026-11-04", "in_short": "The ten designs, none of them run, range from 41 revocation orderings against a simulated purchase to a 7,680-run comparison of defensive agents. We chose every case on purpose, so no study samples a population, and a small pilot that finds no difference doesn’t show two controls are equal. None has a team or a budget yet, and we’d rather hear about a flaw now than after the runs.", "claims": [ { "id": "proposed-studies-46ab6fec", "claim": "The proposed synthetic study compares an ordinary schema baseline, signed fine-grained action authorization, and that same authorization with source mediation; receipt instrumentation is shared and is not credited with preventing prior effects.", "evidence_type": "proposal", "kind": "proposed", "section_url": "https://lugano.ai/research/proposed-studies/#agent-trust", "sources": [] }, { "id": "proposed-studies-c149c8b2", "claim": "The proposed pilot has 96 cases and 20 repeats per arm, or 1,920 executions per arm and 5,760 total. Effect prevention uses 56 adversarial cases and 1,120 repeats per arm; 16 receipt-validation cases and 320 repeats are a separate endpoint; ordinary completion uses 24 cases and 480 repeats.", "evidence_type": "proposal", "kind": "proposed", "section_url": "https://lugano.ai/research/proposed-studies/#agent-trust", "sources": [] }, { "id": "proposed-studies-f9c5b314", "claim": "The proposed study retains task, attempt, decision, effect, evidence, and terminal dispositions; freezes fixture-author, monitor-builder, and outcome-analyst access rules; records label provenance, production burden, agreement, reconciliation, and seeded-label probes; distinguishes binding, source, nonce/revocation, and specification failures from missing coverage and other invalidating conditions; and keeps adaptive search (up to 80 candidate evaluations per target arm, 240 overall) and transfer evaluation (240 runs per arm, 720 overall) on explicit separate budgets.", "evidence_type": "proposal", "kind": "proposed", "section_url": "https://lugano.ai/research/proposed-studies/#agent-trust", "sources": [] }, { "id": "proposed-studies-de1b3a78", "claim": "The local fixture separates intended task, submitted proposal and signed object; a signed approval for the wrong task is scored as specification failure even if the monitor correctly accepts it.", "evidence_type": "proposal", "kind": "proposed", "section_url": "https://lugano.ai/research/proposed-studies/#agent-trust", "sources": [] }, { "id": "proposed-studies-0b3175ba", "claim": "The proposed C-versus-B comparison isolates added source enforcement over a common fine-grained signed-action baseline; it cannot identify an incremental signature, token, receipt, or recipient-scope benefit.", "evidence_type": "proposal", "kind": "proposed", "section_url": "https://lugano.ai/research/proposed-studies/#agent-trust", "sources": [] }, { "id": "proposed-studies-ee5bc0a8", "claim": "The proposed evidence cases use independently built cryptographic and semantic fixtures because Lugano’s archived AAR v0.1 checker had a recorded proof-path bug; a local verifier’s acceptance is not treated as ground truth.", "evidence_type": "proposal", "kind": "proposed", "section_url": "https://lugano.ai/research/proposed-studies/#agent-trust", "sources": [ { "id": 1, "title": "Receipt verifier — limited independent proof-path review (2 November 2026)", "author": "Local artifact review", "year": "2026", "url": "https://lugano.ai/research/proposed-studies/#source-1" } ] }, { "id": "proposed-studies-a8bd7ee4", "claim": "An external control/data separation can be evaluated as a distinct mechanism only if a fixed checkpoint, task permissions, source corpus, policy scope, tool paths, and terminal-state observation are matched and reported across configurations.", "evidence_type": "our-analysis", "kind": "local-method-analysis", "section_url": "https://lugano.ai/research/proposed-studies/#prompt-injection", "sources": [] }, { "id": "proposed-studies-6d70e44a", "claim": "The proposed study compares baseline serialization, source-marked serialization, and an external checked evidence/data route using a fixed model configuration, common task capability and episode ceilings, synthetic effects, and task-approved data slots and branches.", "evidence_type": "proposal", "kind": "proposed", "section_url": "https://lugano.ai/research/proposed-studies/#prompt-injection", "sources": [] }, { "id": "proposed-studies-54a6b86a", "claim": "The proposed primary cohort contains 16 base-task clusters, each with one ordinary condition and two attack variants, for 48 conditions and 12 repeats per arm: 576 runs per arm and 1,728 total. Uncertainty preserves each base task’s ordinary reference, both attacks, all arms and repeats; adaptive search and transfer evaluation remain separate.", "evidence_type": "proposal", "kind": "proposed", "section_url": "https://lugano.ai/research/proposed-studies/#prompt-injection", "sources": [] }, { "id": "proposed-studies-07df960c", "claim": "The proposed explanation is challenged by forbidden edges or arguments, lost labels, prohibited simulated effects, rejected legitimate data use, missing coverage, or adaptive counterexamples. It cannot claim superiority if source marking gives similar outcomes at lower cost.", "evidence_type": "proposal", "kind": "proposed", "section_url": "https://lugano.ai/research/proposed-studies/#prompt-injection", "sources": [] }, { "id": "proposed-studies-71540030", "claim": "The local design permits task-approved source values in inert tool payloads or preauthorized branches; refusal of those required uses is scored as lost capability.", "evidence_type": "proposal", "kind": "proposed", "section_url": "https://lugano.ai/research/proposed-studies/#prompt-injection", "sources": [] }, { "id": "proposed-studies-ac116933", "claim": "The proposed source-marked arm tests serialization on a frozen checkpoint and cannot claim to reproduce the published instruction-hierarchy training result.", "evidence_type": "our-analysis", "kind": "analysis", "section_url": "https://lugano.ai/research/proposed-studies/#prompt-injection", "sources": [ { "id": 2, "title": "The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions (arXiv preprint)", "author": "Eric Wallace et al.", "year": "2024", "url": "https://arxiv.org/abs/2404.13208v1" } ] }, { "id": "proposed-studies-070d768d", "claim": "The proposed adaptive track uses four post-lock cases, at most 20 candidate evaluations per case and target arm with payloads capped at 4,096 tokens (up to 80 per target arm, 240 overall), and a frozen-candidate transfer matrix of 144 runs per arm, 432 overall, kept separate from the primary cohort.", "evidence_type": "proposal", "kind": "proposed", "section_url": "https://lugano.ai/research/proposed-studies/#prompt-injection", "sources": [] }, { "id": "proposed-studies-e7df39d8", "claim": "The unrun Lugano study would compare five equally capable sandbox arms (baseline, tool allowlist, strict data-flow rule, argument-level rule, and that rule with review) across network- and account-containment families, with declared defender and attacker budgets, replay and adaptive tracks, state-observer checks, and full assigned-run accounting. Its proposed larger cohort is 192 scenario conditions with eight matched repeats per arm (1,536 runs per arm; 7,680 overall). Two co-primary endpoints compare the argument-level rule with the allowlist on 256 runs per arm each: completed wrong-target effects in 32 hostile-evidence wrong-target scenarios, and non-inferiority of completed correct writes in 32 unusual-target scenarios within an operator margin fixed before runs; an interval too wide to decide is reported as inconclusive. Half of the hostile wrong-target scenarios reach the structured record. The design counts as supported only if both hold. A described guardrail reports completed correct writes in all 64 evidence-directed scenarios (512 runs per arm). All other outcomes and comparisons are exploratory.", "evidence_type": "proposal", "kind": "proposed research method", "section_url": "https://lugano.ai/research/proposed-studies/#ai-defense", "sources": [] }, { "id": "proposed-studies-3408fab4", "claim": "Anthropic reports four partner-evaluation incidents with unintended internet access and absent released-product cyber safeguards; this motivates testing actual egress, without estimating production prevalence.", "evidence_type": "first-party", "kind": "first-party evaluation-incident assessment", "section_url": "https://lugano.ai/research/proposed-studies/#ai-defense", "sources": [ { "id": 3, "title": "An alignment assessment of recent cybersecurity incidents", "author": "Anthropic", "year": "2026", "url": "https://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents" } ] }, { "id": "proposed-studies-ac32368f", "claim": "In Microsoft AI Red Team’s PyRIT analysis, the harm-proxy run and task-achievement-judge rerun produced different adversarial-model orderings; the rerun also changed harness and responses, so the comparison does not isolate scorer effects.", "evidence_type": "research", "kind": "published preliminary evaluation", "section_url": "https://lugano.ai/research/proposed-studies/#ai-defense", "sources": [ { "id": 7, "title": "Choosing Adversarial Models for Automated Red Teaming with PyRIT", "author": "Victor Valbuena, Microsoft AI Red Team", "year": "2026", "url": "https://github.com/microsoft/PyRIT/blob/5fb4fb977097929b0a1cd1f7b10fb54fb03281a8/doc/blog/2026_09_03_adversarial_model_selection.md" } ] }, { "id": "proposed-studies-e2d02a56", "claim": "NIST AI 600-1 is a voluntary Generative AI risk-management profile that addresses governance, lifecycle risk management, and evaluation.", "evidence_type": "official", "kind": "official guidance", "section_url": "https://lugano.ai/research/proposed-studies/#ai-defense", "sources": [ { "id": 8, "title": "Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1)", "author": "Chloe Autio et al.", "year": "2024", "url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence" } ] }, { "id": "proposed-studies-95967a5c", "claim": "The protocol sources reviewed here each define one check (structured authorization, revocation, status query, sender binding, security guidance, a high-security profile, mandates, issuer authentication); none of them measures how long one purchase stays exposed after revocation with those checks chained together.", "evidence_type": "our-analysis", "kind": "analysis", "section_url": "https://lugano.ai/research/proposed-studies/#agentic-finance", "sources": [ { "id": 9, "title": "RFC 9396: OAuth 2.0 Rich Authorization Requests", "author": "T. Lodderstedt, J. Richer, and B. Campbell; IETF", "year": "2023", "url": "https://www.rfc-editor.org/rfc/rfc9396.html" }, { "id": 10, "title": "RFC 7009: OAuth 2.0 Token Revocation", "author": "T. Lodderstedt, S. Dronia, and M. Scurtescu; IETF", "year": "2013", "url": "https://www.rfc-editor.org/rfc/rfc7009.html" }, { "id": 11, "title": "RFC 7662: OAuth 2.0 Token Introspection", "author": "J. Richer; IETF", "year": "2015", "url": "https://www.rfc-editor.org/rfc/rfc7662.html" }, { "id": 12, "title": "RFC 9449: OAuth 2.0 Demonstrating Proof of Possession (DPoP)", "author": "D. Fett and colleagues; IETF", "year": "2023", "url": "https://www.rfc-editor.org/rfc/rfc9449.html" }, { "id": 13, "title": "RFC 9700: Best Current Practice for OAuth 2.0 Security", "author": "T. Lodderstedt, J. Bradley, A. Labunets, and D. Fett; IETF", "year": "2025", "url": "https://www.rfc-editor.org/rfc/rfc9700.html" }, { "id": 14, "title": "FAPI 2.0 Security Profile", "author": "D. Fett, D. Tonge, J. Heenan, and the OpenID Foundation FAPI Working Group", "year": "2025", "url": "https://openid.net/specs/fapi-security-profile-2_0.html" }, { "id": 15, "title": "Agentic Payment Protocol (AP2) v0.2, pinned source", "author": "Google Agentic Commerce", "year": "2026", "url": "https://github.com/google-agentic-commerce/AP2/blob/e1ea56db72a6385bce3e5c1112b3a56ce60acb43/docs/ap2/specification.md" }, { "id": 16, "title": "EMV 3-D Secure", "author": "EMVCo", "year": "2026", "url": "https://www.emvco.com/emv-technologies/3-d-secure/" }, { "id": 17, "title": "EMV 3-D Secure White Paper v2.0, online edition", "author": "EMVCo", "year": "2025", "url": "https://www.emvco.com/dynamic/emv-3-d-secure-whitepaper-v2/" } ] }, { "id": "proposed-studies-98cdf0f2", "claim": "RFC 7009 has the authorization server invalidate a token before it reports success, so the proposed model treats revocation acknowledgement as invalidation of the grant and its tokens. Grant-wide invalidation is a modeling choice, because RFC 7009 makes invalidating same-grant access tokens a SHOULD; the fresh-read state uses the no-cache option RFC 7662 describes for highly sensitive environments.", "evidence_type": "official", "kind": "protocol specification and modeling assumption", "section_url": "https://lugano.ai/research/proposed-studies/#agentic-finance", "sources": [ { "id": 10, "title": "RFC 7009: OAuth 2.0 Token Revocation", "author": "T. Lodderstedt, S. Dronia, and M. Scurtescu; IETF", "year": "2013", "url": "https://www.rfc-editor.org/rfc/rfc7009.html" }, { "id": 11, "title": "RFC 7662: OAuth 2.0 Token Introspection", "author": "J. Richer; IETF", "year": "2015", "url": "https://www.rfc-editor.org/rfc/rfc7662.html" } ] }, { "id": "proposed-studies-227767c5", "claim": "The unrun study has two stages. Stage one lists all 41 revocation orderings in a stated model (5 for arm 1; 18 each for arms 2 and 3 across two final-check placements and two cache states) and runs the other 12 templates once per arm in scripted order (36 runs), with no repeats. Stage two keeps 15 base templates (three in each of five categories) under four pre-registered delay-and-fault seeds shared by three core arms (60 assigned cases per arm, 180 total), plus a separate 60-assignment short-lifetime sensitivity of local-bearer validation. Four seeds can show that an ordering occurs; they support no rate or power claim.", "evidence_type": "proposal", "kind": "proposal", "section_url": "https://lugano.ai/research/proposed-studies/#agentic-finance", "sources": [] }, { "id": "proposed-studies-8d096409", "claim": "Within the stated ordering model, hand derivation expects commits after acknowledgement in 3 of 5 arm-1 orderings and, in each of arms 2 and 3, in 1 of 5 (fresh, separate check), 0 of 4 (fresh, check inside commit), 2 of 5 (cached, separate) and 1 of 4 (cached, inside commit). These are a test oracle for the unrun stage one, not results.", "evidence_type": "proposal", "kind": "proposal", "section_url": "https://lugano.ai/research/proposed-studies/#agentic-finance", "sources": [] }, { "id": "proposed-studies-4973eb5d", "claim": "Liquid publishes open-weight decision models, including d1-2B with 1.92 billion parameters, pitched for routing, triage, moderation and guardrails. Using one as an on-device privacy gate before a prompt is sent is our untested proposal.", "evidence_type": "proposal", "kind": "proposal", "section_url": "https://lugano.ai/research/proposed-studies/#cheap-inference", "sources": [ { "id": 18, "title": "Decision models (documentation)", "author": "Liquid AI", "year": "2026", "url": "https://docs.liquid.ai/lfm/models/decision-models" }, { "id": 19, "title": "d1-2B model card", "author": "Liquid AI (Hugging Face)", "year": "2026", "url": "https://huggingface.co/LiquidAI/d1-2B" } ] }, { "id": "proposed-studies-d910d60c", "claim": "Liquid’s d1-2B model card says it is not a chat model and that knowledge-heavy questions favor larger models.", "evidence_type": "first-party", "kind": "first-party-documentation", "section_url": "https://lugano.ai/research/proposed-studies/#cheap-inference", "sources": [ { "id": 19, "title": "d1-2B model card", "author": "Liquid AI (Hugging Face)", "year": "2026", "url": "https://huggingface.co/LiquidAI/d1-2B" } ] }, { "id": "proposed-studies-4915f8a4", "claim": "At the Decision Index’s launch, Artificial Analysis found accuracy below stated probability for the decision models it tested.", "evidence_type": "research", "kind": "independent-measurement", "section_url": "https://lugano.ai/research/proposed-studies/#cheap-inference", "sources": [ { "id": 20, "title": "Artificial Analysis Decision Index v1.0", "author": "Artificial Analysis", "year": "2026", "url": "https://artificialanalysis.ai/articles/artificial-analysis-decision-index" } ] }, { "id": "proposed-studies-ddf847da", "claim": "PAPILLON’s local rewriting pipeline kept quality on 85.5% of 237 held-out real queries, from a 901-query benchmark, while leaking 7.5% of personal details.", "evidence_type": "research", "kind": "peer-reviewed-research", "section_url": "https://lugano.ai/research/proposed-studies/#cheap-inference", "sources": [ { "id": 21, "title": "PAPILLON: Privacy Preservation from Internet-based and Local Language Model Ensembles", "author": "Li Siyan, Vethavikashini Chithrra Raghuram, Omar Khattab, Julia Hirschberg, Zhou Yu", "year": "2025", "url": "https://arxiv.org/abs/2410.17127" } ] }, { "id": "proposed-studies-1e7a3eaf", "claim": "The proposed, unrun privacy pilot compares a minimization bundle against a broad-context baseline and adds effect mediation in a separate contrast; it preserves task-required facts and counts every selector, model, trace, and store path. Purpose is an encoded policy field, not inferred intent.", "evidence_type": "proposal", "kind": "proposed-study", "section_url": "https://lugano.ai/research/proposed-studies/#private-information", "sources": [] }, { "id": "proposed-studies-22563972", "claim": "The proposed primary pilot has 48 cases, 12 repeats per case and arm, 576 runs per arm and 1,728 overall; disclosure, effect, utility, and retention use their stated case cohorts and retain unresolved runs.", "evidence_type": "proposal", "kind": "proposed-study", "section_url": "https://lugano.ai/research/proposed-studies/#private-information", "sources": [] }, { "id": "proposed-studies-94dbc38f", "claim": "The local proposed rubric treats exact-string absence as insufficient for its semantic-disclosure endpoint and limits retention assessment to named stores and inspection times.", "evidence_type": "proposal", "kind": "local-proposed-study", "section_url": "https://lugano.ai/research/proposed-studies/#private-information", "sources": [] }, { "id": "proposed-studies-10372a82", "claim": "The privacy study is a proposed application and evaluation of established controls, not a new primitive; it excludes training extraction and unobserved provider internals.", "evidence_type": "our-analysis", "kind": "local-scope", "section_url": "https://lugano.ai/research/proposed-studies/#private-information", "sources": [] }, { "id": "proposed-studies-49caf440", "claim": "The proposed adaptive track uses five post-lock route cases, at most 20 candidate evaluations per case and target arm with payloads capped at 4,096 tokens (up to 100 per target arm, 300 overall), and a frozen-candidate transfer matrix of 180 runs per arm, 540 overall, outside the 1,728 primary runs.", "evidence_type": "proposal", "kind": "proposed-study", "section_url": "https://lugano.ai/research/proposed-studies/#private-information", "sources": [] }, { "id": "proposed-studies-666dfc84", "claim": "NEAR’s own SDKs at version 0.2.1 verify gateway evidence before sending and stop the request when a required check fails.", "evidence_type": "first-party", "kind": "first-party-documentation", "section_url": "https://lugano.ai/research/proposed-studies/#private-ai-verification", "sources": [ { "id": 22, "title": "NEAR AI Cloud documentation: inference SDK", "author": "NEAR AI", "year": "2026", "url": "https://docs.near.ai/cloud/inference-sdk/index.md" }, { "id": 26, "title": "NEAR AI Inference SDK (README and v0.2.1 release)", "author": "NEAR AI", "year": "2026", "url": "https://github.com/nearai/inference-sdk" } ] }, { "id": "proposed-studies-27d1d51c", "claim": "Nillion’s n8n node checks the enclave’s AMD SEV-SNP attestation before sending but still sends the prompt when the check fails.", "evidence_type": "first-party", "kind": "first-party-documentation", "section_url": "https://lugano.ai/research/proposed-studies/#private-ai-verification", "sources": [ { "id": 24, "title": "n8n-nodes-nilai", "author": "Nillion", "year": "2026", "url": "https://github.com/NillionNetwork/n8n-nodes-nilai/tree/f5dac9444bc9e573d552b1f9ce5b5981a987b014" } ] }, { "id": "proposed-studies-a5f8be70", "claim": "In E2EE mode Venice documents a client-side flow that checks the attestation and encrypts to the enclave’s key before sending, though its reference code relies on the server’s verified flag and a nonce match.", "evidence_type": "first-party", "kind": "first-party-documentation", "section_url": "https://lugano.ai/research/proposed-studies/#private-ai-verification", "sources": [ { "id": 25, "title": "Venice documentation: TEE and E2EE models", "author": "Venice.ai", "year": "2026", "url": "https://docs.venice.ai/guides/features/tee-e2ee-models" } ] }, { "id": "proposed-studies-05a39653", "claim": "Phala offers the ACI verifier SDK and Private AI Proxy for client-side checks of its gateway.", "evidence_type": "first-party", "kind": "first-party-documentation", "section_url": "https://lugano.ai/research/proposed-studies/#private-ai-verification", "sources": [ { "id": 23, "title": "Phala Cloud confidential AI documentation: verify attestation", "author": "Phala Network", "year": "2026", "url": "https://docs.phala.com/phala-cloud/confidential-ai/verify/verify-attestation.md" } ] }, { "id": "proposed-studies-ce00a413", "claim": "Tinfoil’s SDK, used by its quickstart, and Privatemode’s SDK or local proxy, used by its API quickstart, check attestation before sending.", "evidence_type": "first-party", "kind": "first-party-documentation", "section_url": "https://lugano.ai/research/proposed-studies/#private-ai-verification", "sources": [ { "id": 27, "title": "Tinfoil documentation: quickstart", "author": "Tinfoil", "year": "2026", "url": "https://docs.tinfoil.sh/quickstart" }, { "id": 28, "title": "Privatemode documentation: API quickstart", "author": "Edgeless Systems", "year": "2026", "url": "https://docs.privatemode.ai/getting-started/api/" }, { "id": 29, "title": "Privatemode documentation: attestation overview", "author": "Edgeless Systems", "year": "2026", "url": "https://docs.privatemode.ai/security/attestation/overview/" } ] }, { "id": "proposed-studies-c50bc056", "claim": "TEE.fail made a machine outside any TEE, fitted with an NVIDIA 3060, pass the TDX and NVIDIA attestation checks of a modified vllm-proxy by pairing a forged TDX quote with a genuine H100 attestation relayed from a rented server, because NVIDIA does not bind an H100 to the identity of a specific VM.", "evidence_type": "research", "kind": "peer-reviewed-research", "section_url": "https://lugano.ai/research/proposed-studies/#private-ai-verification", "sources": [ { "id": 30, "title": "TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition", "author": "Jalen Chuang, Alex Seto, Nicolas Berrios, Stephan van Schaik, Christina Garman, Daniel Genkin", "year": "2025", "url": "https://tee.fail/files/paper.pdf" } ] }, { "id": "proposed-studies-80ddd6b9", "claim": "TEE.fail’s authors said in 2025 that there are no mitigations on NVIDIA’s side, since the attack does not directly target NVIDIA’s confidential-computing features.", "evidence_type": "research", "kind": "researcher-statement", "section_url": "https://lugano.ai/research/proposed-studies/#private-ai-verification", "sources": [ { "id": 31, "title": "TEE.fail project site", "author": "Jalen Chuang, Alex Seto, Nicolas Berrios, Stephan van Schaik, Christina Garman, Daniel Genkin (Georgia Tech, Purdue University, van Schaik LLC)", "year": "2025", "url": "https://tee.fail/" } ] }, { "id": "proposed-studies-0a79a8ad", "claim": "Phala’s documentation says a genuine GPU attestation alone does not show that the GPU is bound to the serving CPU enclave.", "evidence_type": "first-party", "kind": "first-party-documentation", "section_url": "https://lugano.ai/research/proposed-studies/#private-ai-verification", "sources": [ { "id": 32, "title": "Phala Cloud confidential AI documentation: providers", "author": "Phala Network", "year": "2026", "url": "https://docs.phala.com/phala-cloud/confidential-ai/confidential-model/providers.md" } ] }, { "id": "proposed-studies-f5aba6ed", "claim": "The unrun 54-scenario, 18-matter pilot retains 1,728 machine artifacts but assigns human review only to repeat index 0: 54 per variant and 216 overall, requiring at least 12 reviewers under the one-view-per-matter rule. Other repeats remain machine sensitivity data, not human ratings. Recruitment/power are unconfirmed; reviewer/matter clustering, missing assignments and duplicate load stay explicit. Selected-repeat linkage uses 54 positive and 1,377 negative pairs per variant. Decision gate counts are selected clustered fixtures: one decision is 1/18 (5.6 percentage points), a step size rather than an IID precision claim. Disclosure attacks use frozen S0 record-only and S1 54-entry-per-field synthetic dictionaries with declared side information and no external enrichment.", "evidence_type": "proposal", "kind": "proposed-study", "section_url": "https://lugano.ai/research/proposed-studies/#private-verification", "sources": [] }, { "id": "proposed-studies-3732adbe", "claim": "Proposed Arm D/v1 fixes a five-field, length-delimited SHA-256 commitment encoding and signed opening manifest for the selected synthetic fixtures. It defines a test condition only: no formal binding/hiding proof, implementation result, real-world privacy guarantee, or allocation change is claimed.", "evidence_type": "proposal", "kind": "proposed-protocol", "section_url": "https://lugano.ai/research/proposed-studies/#private-verification", "sources": [ { "id": 33, "title": "RFC 8785: JSON Canonicalization Scheme (JCS)", "author": "Anders Rundgren, Bret Jordan, Samuel Erdtman", "year": "2020", "url": "https://www.rfc-editor.org/rfc/rfc8785.html" }, { "id": 34, "title": "FIPS 180-4: Secure Hash Standard (SHS)", "author": "National Institute of Standards and Technology", "year": "2015", "url": "https://csrc.nist.gov/pubs/fips/180-4/upd1/final" } ] }, { "id": "proposed-studies-1b5f36e4", "claim": "The unrun Lugano protocol specifies a 12-pair, 144-scheduled-run selected-fixture pilot of evidence-matched direct, citation-required, and checked workflows, with separate reference-label, checker-building, and outcome-review roles; its paired task-cluster analysis is descriptive rather than a power or population-rate claim.", "evidence_type": "proposal", "kind": "proposal", "section_url": "https://lugano.ai/research/proposed-studies/#model-reliability", "sources": [] }, { "id": "proposed-studies-47b35d09", "claim": "The proposed variants each change one irrelevant feature while preserving the correct answer, building on published position, view-matching and indirect-injection tests.", "evidence_type": "proposal", "kind": "proposal", "section_url": "https://lugano.ai/research/proposed-studies/#model-reliability", "sources": [ { "id": 35, "title": "Lost in the Middle: How Language Models Use Long Contexts", "author": "Nelson F. Liu and colleagues", "year": "2023", "url": "https://arxiv.org/abs/2307.03172" }, { "id": 36, "title": "Towards Understanding Sycophancy in Language Models", "author": "Mrinank Sharma and colleagues", "year": "2023", "url": "https://arxiv.org/abs/2310.13548" }, { "id": 37, "title": "Not What You’ve Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection", "author": "Kai Greshake and colleagues", "year": "2023", "url": "https://arxiv.org/abs/2302.12173" } ] }, { "id": "proposed-studies-72ea9590", "claim": "With 48 scheduled outputs per arm, one outcome moves an arm’s displayed rate by 1/48, or 2.1 percentage points; 288 initial outcome ratings come from two reviewers scoring all 144 first artifacts.", "evidence_type": "proposal", "kind": "proposal", "section_url": "https://lugano.ai/research/proposed-studies/#model-reliability", "sources": [] }, { "id": "proposed-studies-0e391105", "claim": "The unrun public-source feasibility pilot specifies three unrelated chains, two frozen disclosure stages, two formats, and two reviewers per cell (24 assigned assessments), with independent source annotation, display-equivalence review, outcome coding, and chain-level descriptive analysis; it makes no recruitment, power, or general-benefit claim.", "evidence_type": "proposal", "kind": "proposed research method", "section_url": "https://lugano.ai/research/proposed-studies/#breach-analysis", "sources": [] } ] }, { "slug": "receipt-verifier", "title": "What does a receipt check actually establish?", "url": "https://lugano.ai/research/receipt-verifier/", "published": "2026-11-02", "revised": "2026-11-04", "in_short": "Our archived v0.1 verifier passed a receipt holding two retained values, 99 then 0, because its parser kept the last. A signature can vouch for bytes, never for the events those bytes describe, so a result should list the checks it ran and stop there. If a maintained signed-JSON library can print a result that plain, use it.", "claims": [ { "id": "receipt-verifier-ec286bc2", "claim": "Historical AAR v0.1 material: The draft and prototype use independently supplied runtime and log keys and a signed tree head; no production infrastructure is established.", "evidence_type": "our-design", "kind": "local-implementation", "section_url": "https://lugano.ai/research/receipt-verifier/#independent-trust", "sources": [ { "id": 4, "title": "Historical v0.1 — Attested Agent Receipt (AAR) v0.1", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/receipt-verifier/#source-4" }, { "id": 5, "title": "Historical v0.1 — AAR reference verifier README", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/receipt-verifier/#source-5" } ] }, { "id": "receipt-verifier-46633169", "claim": "RFC 8785 specifies deterministic JSON canonicalization and input checking; the prototype identifies its implementation as a subset.", "evidence_type": "our-analysis", "kind": "official-and-local", "section_url": "https://lugano.ai/research/receipt-verifier/#what-checked", "sources": [ { "id": 1, "title": "RFC 8785: JSON Canonicalization Scheme", "author": "RFC Editor", "year": "2020", "url": "https://www.rfc-editor.org/rfc/rfc8785.html" }, { "id": 6, "title": "Historical v0.1 — AAR reference verifier source", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/receipt-verifier/#source-6" } ] }, { "id": "receipt-verifier-fd9b8a53", "claim": "Historical AAR v0.1 material: An independent synthetic check found that the local inclusion routine returned a different root for valid paths at four positions in one eight-leaf tree; the supplied passing fixture uses index 5, whose direction sequence is symmetric. Broader compatibility and security validation remain open.", "evidence_type": "our-study", "kind": "local-synthetic-check", "section_url": "https://lugano.ai/research/receipt-verifier/#what-checked", "sources": [ { "id": 2, "title": "RFC 9162: Certificate Transparency Version 2.0", "author": "RFC Editor", "year": "2021", "url": "https://www.rfc-editor.org/rfc/rfc9162.html" }, { "id": 6, "title": "Historical v0.1 — AAR reference verifier source", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/receipt-verifier/#source-6" }, { "id": 7, "title": "Independent synthetic check of receipt-verifier inclusion paths", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/receipt-verifier/#source-7" }, { "id": 8, "title": "Internal synthetic verifier artifact checks, 2 November 2026", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/receipt-verifier/#source-8" }, { "id": 9, "title": "Portable synthetic verifier-check runner", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/receipt-verifier/#source-9" }, { "id": 10, "title": "Synthetic verifier-check result transcript", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/receipt-verifier/#source-10" } ] }, { "id": "receipt-verifier-2dc318a6", "claim": "Historical AAR v0.1 material: The prototype attempts signature, signed-head and inclusion checks, compares retained with zero, summarizes supplied entries and skips attestation-root validation; those checks do not enforce the proposed field inventory.", "evidence_type": "our-design", "kind": "local-implementation", "section_url": "https://lugano.ai/research/receipt-verifier/#what-checked", "sources": [ { "id": 5, "title": "Historical v0.1 — AAR reference verifier README", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/receipt-verifier/#source-5" }, { "id": 6, "title": "Historical v0.1 — AAR reference verifier source", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/receipt-verifier/#source-6" } ] }, { "id": "receipt-verifier-2ed2e3bc", "claim": "Historical AAR v0.1 material: The synthetic receipt passes with supplied trust and signed head, is unverified without trust, and the tampered and forged-root fixtures fail; the forged-root fixture fails signature while its log inclusion passes.", "evidence_type": "our-study", "kind": "local-fixture-check", "section_url": "https://lugano.ai/research/receipt-verifier/#reading-results", "sources": [ { "id": 8, "title": "Internal synthetic verifier artifact checks, 2 November 2026", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/receipt-verifier/#source-8" }, { "id": 10, "title": "Synthetic verifier-check result transcript", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/receipt-verifier/#source-10" } ] }, { "id": "receipt-verifier-b6e00e88", "claim": "Credential verification does not imply the truth of encoded claims.", "evidence_type": "official", "kind": "official-specification", "section_url": "https://lugano.ai/research/receipt-verifier/#independent-trust", "sources": [ { "id": 3, "title": "Verifiable Credentials Data Model v2.0", "author": "World Wide Web Consortium", "year": "2025", "url": "https://www.w3.org/TR/vc-data-model/" } ] }, { "id": "receipt-verifier-668427a9", "claim": "Historical AAR v0.1 material: The draft contains conflicting descriptions of the signed message, while the prototype verifies canonical body bytes and computes their hash separately.", "evidence_type": "our-study", "kind": "local-code-review", "section_url": "https://lugano.ai/research/receipt-verifier/#what-checked", "sources": [ { "id": 4, "title": "Historical v0.1 — Attested Agent Receipt (AAR) v0.1", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/receipt-verifier/#source-4" }, { "id": 6, "title": "Historical v0.1 — AAR reference verifier source", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/receipt-verifier/#source-6" } ] }, { "id": "receipt-verifier-6009b72b", "claim": "Historical AAR v0.1 material: A bounded constructed one-leaf receipt missing most draft fields returned VERIFIED; a duplicate retained property with final value zero did too. Locally generated issuer/log keys were explicitly accepted for these tests.", "evidence_type": "our-study", "kind": "local-synthetic-check", "section_url": "https://lugano.ai/research/receipt-verifier/#what-checked", "sources": [ { "id": 6, "title": "Historical v0.1 — AAR reference verifier source", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/receipt-verifier/#source-6" }, { "id": 8, "title": "Internal synthetic verifier artifact checks, 2 November 2026", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/receipt-verifier/#source-8" }, { "id": 9, "title": "Portable synthetic verifier-check runner", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/receipt-verifier/#source-9" }, { "id": 10, "title": "Synthetic verifier-check result transcript", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/receipt-verifier/#source-10" } ] }, { "id": "receipt-verifier-e3dfb334", "claim": "Historical AAR v0.1 material: The head signature covers only log ID, root and tree size. An added timestamp is outside those bytes, and the code supplies no trusted event-time or replay check.", "evidence_type": "our-study", "kind": "local-code-review-and-check", "section_url": "https://lugano.ai/research/receipt-verifier/#what-checked", "sources": [ { "id": 4, "title": "Historical v0.1 — Attested Agent Receipt (AAR) v0.1", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/receipt-verifier/#source-4" }, { "id": 6, "title": "Historical v0.1 — AAR reference verifier source", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/receipt-verifier/#source-6" }, { "id": 8, "title": "Internal synthetic verifier artifact checks, 2 November 2026", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/receipt-verifier/#source-8" }, { "id": 9, "title": "Portable synthetic verifier-check runner", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/receipt-verifier/#source-9" }, { "id": 10, "title": "Synthetic verifier-check result transcript", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/receipt-verifier/#source-10" } ] }, { "id": "receipt-verifier-73f6299d", "claim": "Historical AAR v0.1 material: Direct canonicalizer checks preserve a lone surrogate and serialize parsed numeric overflow as null; a full JCS conformance or malformed-input assessment has not been completed.", "evidence_type": "our-study", "kind": "local-synthetic-check", "section_url": "https://lugano.ai/research/receipt-verifier/#what-checked", "sources": [ { "id": 1, "title": "RFC 8785: JSON Canonicalization Scheme", "author": "RFC Editor", "year": "2020", "url": "https://www.rfc-editor.org/rfc/rfc8785.html" }, { "id": 6, "title": "Historical v0.1 — AAR reference verifier source", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/receipt-verifier/#source-6" }, { "id": 8, "title": "Internal synthetic verifier artifact checks, 2 November 2026", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/receipt-verifier/#source-8" }, { "id": 9, "title": "Portable synthetic verifier-check runner", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/receipt-verifier/#source-9" }, { "id": 10, "title": "Synthetic verifier-check result transcript", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/receipt-verifier/#source-10" } ] }, { "id": "receipt-verifier-36c590e1", "claim": "Signed Agent Receipt v0.2 is a bounded offline implementation with a fixed input schema, externally selected issuer and log keys, domain-separated Ed25519 signing bytes, and Merkle membership checks. A pass establishes only that the statement matches the schema, that the selected issuer and log keys signed the statement and tree head, and that the statement is a member of that signed root; it does not establish event truth, completeness, hardware attestation, retention, time, or public-log history. Inventory lists may be empty.", "evidence_type": "our-design", "kind": "local-reference-implementation", "section_url": "https://lugano.ai/research/receipt-verifier/#version-02", "sources": [ { "id": 11, "title": "Signed Agent Receipt Reference Profile v0.2", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/receipt-verifier/#source-11" }, { "id": 12, "title": "Signed Agent Receipt v0.2: README and checker guide", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/receipt-verifier/#source-12" } ] }, { "id": "receipt-verifier-a6c144cf", "claim": "According to its README and internal review record, the v0.2 bundle contains executable tests and deterministic synthetic fixtures, and a separately authored internal adversarial review records coverage, findings and rechecks; its exact inputs, hashes and per-case results are in its validation files, on GitHub with the code. The source code, tests and fixtures are on GitHub, at Lugano-AI/signed-agent-receipt. This is agent-assisted internal review, not external certification or a real-run privacy study.", "evidence_type": "our-study", "kind": "internal-conformance-review", "section_url": "https://lugano.ai/research/receipt-verifier/#version-02", "sources": [ { "id": 12, "title": "Signed Agent Receipt v0.2: README and checker guide", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/receipt-verifier/#source-12" }, { "id": 13, "title": "Signed Agent Receipt v0.2: internal review record", "author": "Lugano Labs", "year": "2026", "url": "https://lugano.ai/research/receipt-verifier/#source-13" } ] } ] } ] }