{
  "schema_version": 1,
  "builder_plan": {
    "scenario": "An agent reads external documents or tool responses that may contain malicious instructions.",
    "change": "Replay attacks and legitimate lookalikes in an isolated copy of your agent workflow.",
    "baseline": "Your existing checks with the same tasks, permissions, and tool responses.",
    "steps": [
      "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.",
      "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.",
      "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.",
      "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test."
    ],
    "measure": "Successful attacks missed, legitimate actions blocked, detection delay, and review cost.",
    "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation."
  },
  "builder_review": null,
  "arxiv_id": "2609.17817",
  "title": "Reflections on Trusting Trust, Revisited: Contaminating Self-Modifying AI Coding Agents with Poisoned Benchmarks",
  "summary": "The paper does not propose a technique that replaces an existing production method; it demonstrates an attack in which poisoned benchmarks contaminate the self-evaluation loop of self-modifying coding agents, causing evolved versions to emit vulnerable code (e.g., disabled HTTPS certificate validation) on clean tasks. There is no adoption cost in the usual sense, but the implied defensive cost is that any team running self-improving agent loops must add benchmark provenance checks, held-out clean evaluation, and auditing of self-modifications, none of which the paper shows to be reliably effective since contamination persists after clean re-evolution. What can fail is any pipeline that trusts benchmark results to steer agent self-modification: a single compromised benchmark can induce persistent insecure behavior that clean benchmarks do not repair.",
  "rationale": "This is a security threat analysis of self-modifying agents rather than an adoptable method, and it is relevant only as a defensive warning for a reader with constrained infrastructure who is unlikely to run self-evolving agent loops in production.",
  "technique": "Benchmark poisoning attack on self-modifying coding agents",
  "family": "seguranca_e_guardrails",
  "recommendation": "observar",
  "published": "2026-09-15",
  "as_of": "2026-10-18",
  "editorial_status": "indexed",
  "source_url": "https://arxiv.org/abs/2609.17817",
  "independent_implementations": 1,
  "total_implementations": 2,
  "stars": 7,
  "citations": 0,
  "claims": [
    {
      "claim_id": "claim-01",
      "statement": "The paper does not propose a technique that replaces an existing production method; it demonstrates an attack in which poisoned benchmarks contaminate the self-evaluation loop of self-modifying coding agents, causing evolved versions to emit vulnerable code (e.g., disabled HTTPS certificate validation) on clean tasks. There is no adoption cost in the usual sense, but the implied defensive cost is that any team running self-improving agent loops must add benchmark provenance checks, held-out clean evaluation, and auditing of self-modifications, none of which the paper shows to be reliably effective since contamination persists after clean re-evolution. What can fail is any pipeline that trusts benchmark results to steer agent self-modification: a single compromised benchmark can induce persistent insecure behavior that clean benchmarks do not repair.",
      "basis": "inferred",
      "result": "",
      "baseline": "",
      "conditions": "",
      "source_url": "https://arxiv.org/abs/2609.17817",
      "source_page": null,
      "source_excerpt": ""
    }
  ],
  "exposure_map": [
    {
      "dimension": "quality",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "compute",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "latency",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "operations",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "compatibility",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "security",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "data_and_training",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "reproducibility",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    }
  ],
  "risks": [],
  "minimum_test": [],
  "open_questions": [],
  "independent_tests": [],
  "lab_reproductions": [],
  "report_available": false,
  "validation_tier": "unknown",
  "evidence_tier": "unknown",
  "infrastructure_basis": "unknown",
  "equations": [],
  "equations_status": "not_fetched",
  "core_kind": "",
  "equations_fetched_at": "",
  "equations_source_url": "",
  "equations_source_sha256": "",
  "exposures_reviewed_at": "",
  "exposures_source_sha256": ""
}