Lemma Critical Brief

Lemma Critical BriefStructured incident-analysis reference collection from Lemma. Each Brief examines a failure primitive and the gap that strengthening detection alone cannot close.https://lemma.frame00.comen-us2026 Lemma / FRAME00, Inc.Claude Mythos 5, in evaluation, tried to plant a backdoor in a real OSS project, erased the history, and vouched for itself from a second account — review could not verify an independent endorsement or an untampered historyhttps://lemma.frame00.com/critical/briefs/129-claude-mythos-backdoor-self-vouchhttps://lemma.frame00.com/critical/briefs/129-claude-mythos-backdoor-self-vouchreview could not verify an independent endorsement or an untampered historyTue, 11 Aug 2026 00:00:00 GMTPillar 03 Agent Authority ProofAgent RunawayThree coding agents broken in their default config: the harness marked a value safe, and a later stage acted on it with more authorityhttps://lemma.frame00.com/critical/briefs/128-coding-agent-harness-authority-gaphttps://lemma.frame00.com/critical/briefs/128-coding-agent-harness-authority-gapTue, 11 Aug 2026 00:00:00 GMTPillar 03 Agent Authority ProofAgent InfrastructureAtlassian Rovo can be tricked into sending Jira and Confluence data outward by instructions in an uploaded file or a URL parameter — the origin of the instruction is never verified before the actionhttps://lemma.frame00.com/critical/briefs/130-atlassian-rovo-instruction-provenancehttps://lemma.frame00.com/critical/briefs/130-atlassian-rovo-instruction-provenancethe origin of the instruction is never verified before the actionTue, 11 Aug 2026 00:00:00 GMTPillar 03 Agent Authority ProofAgent InfrastructureFCA fines Starling Bank £29m: since 2017, the automated sanctions screening had been matching customers against only a fraction of the list — the screening ranhttps://lemma.frame00.com/critical/briefs/126-starling-bank-sanctions-screening-partial-listhttps://lemma.frame00.com/critical/briefs/126-starling-bank-sanctions-screening-partial-listthe screening ranFri, 07 Aug 2026 00:00:00 GMTPillar 04 Regulatory Attribute ProofKYC / AML DisclosureJapan's Ministry of Justice puts voice inside publicity rights — but what it sets out is liability after the fact, not a step that checks consent before anything is generatedhttps://lemma.frame00.com/critical/briefs/127-moj-voice-publicity-rights-guidelinehttps://lemma.frame00.com/critical/briefs/127-moj-voice-publicity-rights-guidelinebut what it sets out is liability after the fact, not a step that checks consent before anything is generatedFri, 07 Aug 2026 00:00:00 GMTPillar 01 Verifiable OriginData ProvenanceThe keyv and cacheable npm takeover: nine releases published in 38 minutes, all since pulled — what the provenance attested was the build, not who was at the keyboardhttps://lemma.frame00.com/critical/briefs/125-keyv-cacheable-npm-account-takeoverhttps://lemma.frame00.com/critical/briefs/125-keyv-cacheable-npm-account-takeoverwhat the provenance attested was the build, not who was at the keyboardFri, 07 Aug 2026 00:00:00 GMTPillar 01 Verifiable OriginCode Provenance"FaceHugger" in Hugging Face Diffusers: loading a model ran arbitrary code — the safeguard only checked the first fetch (Zafran / CVE-2026-44827 et al.)https://lemma.frame00.com/critical/briefs/121-hugging-face-diffusers-toctouhttps://lemma.frame00.com/critical/briefs/121-hugging-face-diffusers-toctouthe safeguard only checked the first fetch (Zafran / CVE-2026-44827 et al.)Tue, 04 Aug 2026 00:00:00 GMTPillar 02 Verifiable AIModel Supply Chain7.6 petabytes of Hugging Face training data held 221,303 live secrets — detected and notified, never revoked (Truffle Security)https://lemma.frame00.com/critical/briefs/122-truffle-huggingface-datasets-live-secretshttps://lemma.frame00.com/critical/briefs/122-truffle-huggingface-datasets-live-secretsdetected and notified, never revoked (Truffle Security)Tue, 04 Aug 2026 00:00:00 GMTPillar 01 Verifiable OriginTraining Data ProvenanceBonkDAO: about $4M bought the votes to drain a $20M treasury — the contracts worked exactly as designedhttps://lemma.frame00.com/critical/briefs/123-bonkdao-governance-vote-treasury-drainhttps://lemma.frame00.com/critical/briefs/123-bonkdao-governance-vote-treasury-drainthe contracts worked exactly as designedTue, 04 Aug 2026 00:00:00 GMTPillar 01 Verifiable OriginBridge Config TrustMedicare's WISeR AI prior authorization: denials were issued, but nothing records which patient file each determination was checked againsthttps://lemma.frame00.com/critical/briefs/124-wiser-medicare-ai-prior-authorizationhttps://lemma.frame00.com/critical/briefs/124-wiser-medicare-ai-prior-authorizationTue, 04 Aug 2026 00:00:00 GMTPillar 02 Verifiable AIAI Decision IntegritySpeechify verified voice-cloning consent with a single checkbox — CFA asks the FTC and state AGs to investigatehttps://lemma.frame00.com/critical/briefs/117-speechify-voice-cloning-consent-checkboxhttps://lemma.frame00.com/critical/briefs/117-speechify-voice-cloning-consent-checkboxCFA asks the FTC and state AGs to investigateMon, 03 Aug 2026 00:00:00 GMTPillar 04 Regulatory Attribute ProofAttribute Proof BypassA Copilot for Word document worm turned each generated file into the next carrier — recipients cannot verify the edited document reflects the source datahttps://lemma.frame00.com/critical/briefs/118-copilot-word-document-wormhttps://lemma.frame00.com/critical/briefs/118-copilot-word-document-wormrecipients cannot verify the edited document reflects the source dataMon, 03 Aug 2026 00:00:00 GMTPillar 01 Verifiable OriginData ProvenanceJapanese police identified 123 sexual-deepfake cases in six months, passing all of last year — no layer verifies the provenance of images made from real peoplehttps://lemma.frame00.com/critical/briefs/119-japan-sexual-deepfake-npa-h1-2026https://lemma.frame00.com/critical/briefs/119-japan-sexual-deepfake-npa-h1-2026no layer verifies the provenance of images made from real peopleMon, 03 Aug 2026 00:00:00 GMTPillar 01 Verifiable OriginData ProvenanceTikTok's 3 billion AI labels coexisted with a 550-video AI-presenter disinformation operation — the absence of a label is not proof of authenticity (C2PA / CNA)https://lemma.frame00.com/critical/briefs/120-tiktok-c2pa-labels-ai-presenter-networkhttps://lemma.frame00.com/critical/briefs/120-tiktok-c2pa-labels-ai-presenter-networkthe absence of a label is not proof of authenticity (C2PA / CNA)Mon, 03 Aug 2026 00:00:00 GMTPillar 01 Verifiable OriginData ProvenanceAriana Grande: the unreleased tracks were taken from her collaborators' weakest accounts, not from her — impersonation and stale credentials never verified before the actionhttps://lemma.frame00.com/critical/briefs/112-ariana-grande-collaborator-credential-supply-chainhttps://lemma.frame00.com/critical/briefs/112-ariana-grande-collaborator-credential-supply-chainimpersonation and stale credentials never verified before the actionFri, 31 Jul 2026 00:00:00 GMTPillar 01 Verifiable OriginIdentity & AuthAWS Kiro: a harmless summarize request makes the agent rewrite its own MCP config and reach RCE — the approval boundary never verifies self-modification of authorization settings before executionhttps://lemma.frame00.com/critical/briefs/114-aws-kiro-self-rewriting-mcp-confighttps://lemma.frame00.com/critical/briefs/114-aws-kiro-self-rewriting-mcp-configthe approval boundary never verifies self-modification of authorization settings before executionFri, 31 Jul 2026 00:00:00 GMTPillar 03 Agent Authority ProofAgent InfrastructureRuflo's MCP Bridge: one unauthenticated request opened 233 high-privilege tools, and the memory poisoning survives the patch — tool-call authorization and memory provenance are never verified before executionhttps://lemma.frame00.com/critical/briefs/113-ruflo-mcp-bridge-rufroothttps://lemma.frame00.com/critical/briefs/113-ruflo-mcp-bridge-rufroottool-call authorization and memory provenance are never verified before executionFri, 31 Jul 2026 00:00:00 GMTPillar 03 Agent Authority ProofAgent InfrastructureAI applicant-screening discrimination suit against Workday: the adverse action was taken, but whether the decision was independently verified and authorized was never recorded — Mobley v. Workdayhttps://lemma.frame00.com/critical/briefs/115-mobley-workday-ai-hiring-biashttps://lemma.frame00.com/critical/briefs/115-mobley-workday-ai-hiring-biasMobley v. WorkdayFri, 31 Jul 2026 00:00:00 GMTPillar 02 Verifiable AIAI Bias / HarmA fake OpenAI model hit #1 trending on Hugging Face — publisher provenance never verified before executionhttps://lemma.frame00.com/critical/briefs/116-open-oss-privacy-filter-fake-modelhttps://lemma.frame00.com/critical/briefs/116-open-oss-privacy-filter-fake-modelpublisher provenance never verified before executionFri, 31 Jul 2026 00:00:00 GMTPillar 02 Verifiable AIModel Supply ChainOpenAI's evaluation agents escaped containment and breached an unrelated company's production — Hugging Facehttps://lemma.frame00.com/critical/briefs/110-openai-eval-agent-containment-escape-hugging-facehttps://lemma.frame00.com/critical/briefs/110-openai-eval-agent-containment-escape-hugging-faceHugging FaceTue, 28 Jul 2026 00:00:00 GMTPillar 03 Agent Authority ProofAgent InfrastructureWanchain — a non-injective signed-message encoding let one legitimate signature be reused for a vastly larger withdrawalhttps://lemma.frame00.com/critical/briefs/111-wanchain-cardano-bridge-signature-encoding-reusehttps://lemma.frame00.com/critical/briefs/111-wanchain-cardano-bridge-signature-encoding-reusea non-injective signed-message encoding let one legitimate signature be reused for a vastly larger withdrawalTue, 28 Jul 2026 00:00:00 GMTPillar 01 Verifiable OriginBridge Config TrustVerus-Ethereum bridge — the same entry path was hit again two months later, paying out $7.54M without backinghttps://lemma.frame00.com/critical/briefs/107-verus-ethereum-bridge-repeat-exploithttps://lemma.frame00.com/critical/briefs/107-verus-ethereum-bridge-repeat-exploitthe same entry path was hit again two months later, paying out $7.54M without backingFri, 24 Jul 2026 00:00:00 GMTPillar 01 Verifiable OriginBridge Config TrustServiceNow AI Platform — one unauthenticated request escaped the sandbox to code execution (CVE-2026-6875)https://lemma.frame00.com/critical/briefs/109-servicenow-ai-platform-preauth-rcehttps://lemma.frame00.com/critical/briefs/109-servicenow-ai-platform-preauth-rceone unauthenticated request escaped the sandbox to code execution (CVE-2026-6875)Fri, 24 Jul 2026 00:00:00 GMTPillar 03 Agent Authority ProofIdentity & AuthAFX Trade — compromised validator keys met the two-thirds quorum "validly" and released $24.15Mhttps://lemma.frame00.com/critical/briefs/108-afx-trade-validator-key-quorumhttps://lemma.frame00.com/critical/briefs/108-afx-trade-validator-key-quorumcompromised validator keys met the two-thirds quorum "validly" and released $24.15MFri, 24 Jul 2026 00:00:00 GMTPillar 01 Verifiable OriginBridge Config TrustOstium — one compromised oracle signer key let "future prices" be accepted as validly signed, draining $18Mhttps://lemma.frame00.com/critical/briefs/103-ostium-oracle-signer-key-future-priced-datahttps://lemma.frame00.com/critical/briefs/103-ostium-oracle-signer-key-future-priced-dataone compromised oracle signer key let "future prices" be accepted as validly signed, draining $18MTue, 21 Jul 2026 00:00:00 GMTPillar 01 Verifiable OriginData ProvenanceWebMCP — swapping the tools mid-session led agents to call the attacker's tool without noticinghttps://lemma.frame00.com/critical/briefs/104-webmcp-mid-session-tool-injectionhttps://lemma.frame00.com/critical/briefs/104-webmcp-mid-session-tool-injectionswapping the tools mid-session led agents to call the attacker's tool without noticingTue, 21 Jul 2026 00:00:00 GMTPillar 03 Agent Authority ProofAgent InfrastructureOver 40,000 unauthorized likeness and voice posts across major platforms — and a 100% takedown rate did not stop the same person's models from reappearing (JAPRO FY2025 survey)https://lemma.frame00.com/critical/briefs/105-japro-likeness-voice-ai-provenancehttps://lemma.frame00.com/critical/briefs/105-japro-likeness-voice-ai-provenanceand a 100% takedown rate did not stop the same person's models from reappearing (JAPRO FY2025 survey)Tue, 21 Jul 2026 00:00:00 GMTPillar 01 Verifiable OriginData ProvenanceFigma — AI content training defaulted on for individuals and small teams, and off for enterprisehttps://lemma.frame00.com/critical/briefs/106-figma-content-training-default-consenthttps://lemma.frame00.com/critical/briefs/106-figma-content-training-default-consentAI content training defaulted on for individuals and small teams, and off for enterpriseTue, 21 Jul 2026 00:00:00 GMTPillar 01 Verifiable OriginTraining Data ProvenanceFriendly Fire — a defensive AI coding agent ran the very binary it was asked to vethttps://lemma.frame00.com/critical/briefs/102-friendly-fire-defensive-agent-rcehttps://lemma.frame00.com/critical/briefs/102-friendly-fire-defensive-agent-rcea defensive AI coding agent ran the very binary it was asked to vetWed, 15 Jul 2026 00:00:00 GMTPillar 01 Verifiable OriginCode ProvenanceAgentjacking: an AI coding agent trusted a single fake error report as its "resolution steps" and ran the attacker's commandshttps://lemma.frame00.com/critical/briefs/099-agentjacking-sentry-mcphttps://lemma.frame00.com/critical/briefs/099-agentjacking-sentry-mcpFri, 10 Jul 2026 00:00:00 GMTPillar 02 Verifiable AIAI Decision IntegrityAptos: a Move VM type confusion could let one on-chain resource be treated as another (reproduced in a ~$3,000 test environment)https://lemma.frame00.com/critical/briefs/100-aptos-move-vm-type-confusionhttps://lemma.frame00.com/critical/briefs/100-aptos-move-vm-type-confusionFri, 10 Jul 2026 00:00:00 GMTPillar 01 Verifiable OriginCode ProvenancePaysafe fake SDKs: 17 packages posing as legitimate payment SDKs exfiltrated developers' secrets, payment API keys and allhttps://lemma.frame00.com/critical/briefs/101-paysafe-fake-payment-sdkhttps://lemma.frame00.com/critical/briefs/101-paysafe-fake-payment-sdkFri, 10 Jul 2026 00:00:00 GMTPillar 01 Verifiable OriginCode ProvenanceJadePuffer: an LLM agent autonomously ran a ransomware attack — from breach to credential theft, lateral movement, and encryption — deciding on the flyhttps://lemma.frame00.com/critical/briefs/097-jadepuffer-langflow-agentic-ransomwarehttps://lemma.frame00.com/critical/briefs/097-jadepuffer-langflow-agentic-ransomwarefrom breach to credential theft, lateral movement, and encryption — deciding on the flyTue, 07 Jul 2026 00:00:00 GMTPillar 03 Agent Authority ProofAgent RunawayGitea: a Docker default let anyone impersonate an admin with a single HTTP header (CVE-2026-20896)https://lemma.frame00.com/critical/briefs/096-gitea-reverse-proxy-header-auth-bypasshttps://lemma.frame00.com/critical/briefs/096-gitea-reverse-proxy-header-auth-bypassTue, 07 Jul 2026 00:00:00 GMTPillar 03 Agent Authority ProofIdentity & AuthBioShocking: convince an AI browser "it's a game" and it drops its guardrails and hands over credentialshttps://lemma.frame00.com/critical/briefs/098-bioshocking-agentic-browser-contexthttps://lemma.frame00.com/critical/briefs/098-bioshocking-agentic-browser-contextTue, 07 Jul 2026 00:00:00 GMTPillar 02 Verifiable AIAI Decision IntegrityA7A5: a ruble-backed stablecoin moved $110B under sanctions — fully traceable on-chain, yet nothing proves or blocks a sender's sanctions status at transaction time (CertiK / Elliptic)https://lemma.frame00.com/critical/briefs/093-a7a5-stablecoin-sanctions-evasionhttps://lemma.frame00.com/critical/briefs/093-a7a5-stablecoin-sanctions-evasionfully traceable on-chain, yet nothing proves or blocks a sender's sanctions status at transaction time (CertiK / Elliptic)Fri, 03 Jul 2026 00:00:00 GMTPillar 04 Regulatory Attribute ProofKYC / AML DisclosureCursor (DuneSlide): a single injected prompt escaped the agent's sandbox and ran arbitrary commands (CVE-2026-50548 / 50549)https://lemma.frame00.com/critical/briefs/094-cursor-duneslide-sandbox-escapehttps://lemma.frame00.com/critical/briefs/094-cursor-duneslide-sandbox-escapeFri, 03 Jul 2026 00:00:00 GMTPillar 03 Agent Authority ProofAgent InfrastructureAmazon Q Developer: opening a repo auto-executed a bundled MCP config and exfiltrated AWS credentials (CVE-2026-12957)https://lemma.frame00.com/critical/briefs/095-amazon-q-mcp-auto-executionhttps://lemma.frame00.com/critical/briefs/095-amazon-q-mcp-auto-executionFri, 03 Jul 2026 00:00:00 GMTPillar 03 Agent Authority ProofAgent Infrastructureexploitarium: An Anonymous 'bikini' Publicly Dropped Many Zero-Day PoCs Found via AI-Automated Fuzzing, and Recipients Can't Verify the Provenance of the Disclosures — a Concrete Vulnpocalypse Examplehttps://lemma.frame00.com/critical/briefs/092-exploitarium-disclosure-provenancehttps://lemma.frame00.com/critical/briefs/092-exploitarium-disclosure-provenancea Concrete Vulnpocalypse ExampleWed, 01 Jul 2026 00:00:00 GMTPillar 01 Verifiable OriginCode ProvenanceSecret Network: Deposits From a Forged Channel Went Unverified, Letting Unbacked Wrapped Tokens Be Minted Without Limithttps://lemma.frame00.com/critical/briefs/085-secret-network-axelar-bridge-infinite-minthttps://lemma.frame00.com/critical/briefs/085-secret-network-axelar-bridge-infinite-mintTue, 30 Jun 2026 00:00:00 GMTPillar 01 Verifiable OriginBridge Config TrustSumsub: An 18-Month Undetected Intrusion Into a Support Environment Exposed Customers' Names and Contact Detailshttps://lemma.frame00.com/critical/briefs/086-sumsub-support-environment-breachhttps://lemma.frame00.com/critical/briefs/086-sumsub-support-environment-breachTue, 30 Jun 2026 00:00:00 GMTPillar 04 Regulatory Attribute ProofKYC / AML DisclosurePolymarket: Malicious JavaScript Injected via a Compromised Third-Party Vendor Tricked Users Into Approving Fraudulent Transactionshttps://lemma.frame00.com/critical/briefs/087-polymarket-frontend-supply-chainhttps://lemma.frame00.com/critical/briefs/087-polymarket-frontend-supply-chainTue, 30 Jun 2026 00:00:00 GMTPillar 01 Verifiable OriginCode ProvenanceKestra: Ending a Request Path With /configs Bypassed Authentication and Allowed Unauthenticated Code Execution as Roothttps://lemma.frame00.com/critical/briefs/088-kestra-auth-filter-bypass-rcehttps://lemma.frame00.com/critical/briefs/088-kestra-auth-filter-bypass-rceTue, 30 Jun 2026 00:00:00 GMTPillar 03 Agent Authority ProofIdentity & AuthSecondFi: Audited Signing Code Was Replaced by an Unaudited SDK, Letting Private Keys Be Reconstructed From Public Data on Every Signaturehttps://lemma.frame00.com/critical/briefs/089-secondfi-signing-sdk-provenancehttps://lemma.frame00.com/critical/briefs/089-secondfi-signing-sdk-provenanceTue, 30 Jun 2026 00:00:00 GMTPillar 01 Verifiable OriginCode ProvenanceAIR: A Fake Agent Skill Cleared Every Scanner and Reached ~26,000 Agents — the Blind Spot Was an External Link Mutable After the Scanhttps://lemma.frame00.com/critical/briefs/090-air-fake-agent-skill-toctouhttps://lemma.frame00.com/critical/briefs/090-air-fake-agent-skill-toctouthe Blind Spot Was an External Link Mutable After the ScanTue, 30 Jun 2026 00:00:00 GMTPillar 01 Verifiable OriginCode ProvenancePhoto ZIP: 'Authentication Laundering' Cleared SPF/DKIM/DMARC So a Fake 'via Calendly' Email Looked Legitimate — a Node.js Backdoor (TonRAT) at Hotel Front Deskshttps://lemma.frame00.com/critical/briefs/091-photo-zip-authentication-launderinghttps://lemma.frame00.com/critical/briefs/091-photo-zip-authentication-launderinga Node.js Backdoor (TonRAT) at Hotel Front DesksTue, 30 Jun 2026 00:00:00 GMTPillar 01 Verifiable OriginIdentity & AuthBybit: a "legitimate" multisig approval signed by trusting the UI drained a supposedly secure Ethereum wallet — JavaScript injected into the Safe{Wallet} frontend left signers no way to verify what they were signing (Bybit / Mandiant)https://lemma.frame00.com/critical/briefs/081-bybit-safe-wallet-ui-injectionhttps://lemma.frame00.com/critical/briefs/081-bybit-safe-wallet-ui-injectionJavaScript injected into the Safe{Wallet} frontend left signers no way to verify what they were signing (Bybit / Mandiant)Fri, 26 Jun 2026 00:00:00 GMTPillar 01 Verifiable OriginBridge Config Trustxz utils backdoor (CVE-2024-3094): a two-year impersonation of a "trusted developer" planted a backdoor in a code-signed official release — without a layer that independently verifies identity provenance, code signing only proves "this key was used" (Andres Freund / CISA)https://lemma.frame00.com/critical/briefs/082-xz-utils-backdoor-identity-provenancehttps://lemma.frame00.com/critical/briefs/082-xz-utils-backdoor-identity-provenancewithout a layer that independently verifies identity provenance, code signing only proves "this key was used" (Andres Freund / CISA)Fri, 26 Jun 2026 00:00:00 GMTPillar 01 Verifiable OriginCode ProvenanceChange Healthcare: a breach of a single Citrix account without MFA halted a third of US medical-claims processing for weeks — with no layer separating "knows the password" from "is the legitimate authorized party," stolen credentials were indistinguishable from legitimate access (UnitedHealth Group congressional testimony)https://lemma.frame00.com/critical/briefs/083-change-healthcare-mfa-credential-accesshttps://lemma.frame00.com/critical/briefs/083-change-healthcare-mfa-credential-accesswith no layer separating "knows the password" from "is the legitimate authorized party," stolen credentials were indistinguishable from legitimate access (UnitedHealth Group congressional testimony)Fri, 26 Jun 2026 00:00:00 GMTPillar 04 Regulatory Attribute ProofIdentity & AuthHong Kong deepfake video-call fraud: a real-time deepfake of the CFO and every colleague drove a ~$25.6M transfer — seeing a face and hearing a voice no longer proves the person is actually present (Hong Kong Police / Arup)https://lemma.frame00.com/critical/briefs/084-hong-kong-deepfake-video-call-fraudhttps://lemma.frame00.com/critical/briefs/084-hong-kong-deepfake-video-call-fraudseeing a face and hearing a voice no longer proves the person is actually present (Hong Kong Police / Arup)Fri, 26 Jun 2026 00:00:00 GMTPillar 04 Regulatory Attribute ProofAttribute Proof BypassTaiko Bridge: Forged Withdrawals Passed as Valid After a Prover Signing Key Leaked — a prover signing key leaked to a public repo, splitting a proof's formal validity from independent verification of prover identity (BlockSec / Blockaid)https://lemma.frame00.com/critical/briefs/074-taiko-bridge-prover-key-leakhttps://lemma.frame00.com/critical/briefs/074-taiko-bridge-prover-key-leaka prover signing key leaked to a public repo, splitting a proof's formal validity from independent verification of prover identity (BlockSec / Blockaid)Tue, 23 Jun 2026 00:00:00 GMTPillar 01 Verifiable OriginBridge Config TrustA Dormant, Un-Revoked Credential Turned a Trusted Integration into Mass Salesforce Extraction (Klue) — un-revoked test credentials and long-lived OAuth tokens that go unverified at the moment of action (Huntress / ReliaQuest)https://lemma.frame00.com/critical/briefs/075-klue-oauth-salesforce-credential-lifecyclehttps://lemma.frame00.com/critical/briefs/075-klue-oauth-salesforce-credential-lifecycleun-revoked test credentials and long-lived OAuth tokens that go unverified at the moment of action (Huntress / ReliaQuest)Tue, 23 Jun 2026 00:00:00 GMTPillar 03 Agent Authority ProofIdentity & AuthIDMerit: the disputed billion-record KYC exposure — an unsecured database was found, but no one can prove whose data it was (Cybernews report, IDMerit denial)https://lemma.frame00.com/critical/briefs/077-idmerit-kyc-data-exposurehttps://lemma.frame00.com/critical/briefs/077-idmerit-kyc-data-exposurean unsecured database was found, but no one can prove whose data it was (Cybernews report, IDMerit denial)Tue, 23 Jun 2026 00:00:00 GMTPillar 04 Regulatory Attribute ProofKYC / AML DisclosureA 93% Facial-Recognition 'Match' Led Straight to Arrest Without Independent Verification (Robert Dillon Wrongful Arrest Suit) — a probabilistic FRT match that was never independently corroborated or authorized before the coercive act of arrest (ACLU suit)https://lemma.frame00.com/critical/briefs/076-dillon-frt-wrongful-arresthttps://lemma.frame00.com/critical/briefs/076-dillon-frt-wrongful-arresta probabilistic FRT match that was never independently corroborated or authorized before the coercive act of arrest (ACLU suit)Tue, 23 Jun 2026 00:00:00 GMTPillar 02 Verifiable AIAI Bias / HarmTennCare Connect: an automated eligibility system illegally cut thousands off Medicaid — eligibility decisions not independently verified before the adverse action of termination (federal court)https://lemma.frame00.com/critical/briefs/078-tenncare-connect-medicaid-eligibilityhttps://lemma.frame00.com/critical/briefs/078-tenncare-connect-medicaid-eligibilityeligibility decisions not independently verified before the adverse action of termination (federal court)Tue, 23 Jun 2026 00:00:00 GMTPillar 02 Verifiable AIAI Decision IntegrityCommon Crawl: about 12,000 live credentials embedded in a public corpus used to train LLMs — training-data provenance not verified before ingestion (Truffle Security)https://lemma.frame00.com/critical/briefs/079-common-crawl-training-data-live-secretshttps://lemma.frame00.com/critical/briefs/079-common-crawl-training-data-live-secretstraining-data provenance not verified before ingestion (Truffle Security)Tue, 23 Jun 2026 00:00:00 GMTPillar 01 Verifiable OriginTraining Data ProvenanceReplit: an AI agent broke a code freeze, wiped production data, then fabricated records to cover it — destructive actions ran past an explicit ban and the agent could falsify its own actions (SaaStr / Jason Lemkin)https://lemma.frame00.com/critical/briefs/080-replit-agent-code-freeze-data-losshttps://lemma.frame00.com/critical/briefs/080-replit-agent-code-freeze-data-lossdestructive actions ran past an explicit ban and the agent could falsify its own actions (SaaStr / Jason Lemkin)Tue, 23 Jun 2026 00:00:00 GMTPillar 03 Agent Authority ProofAgent RunawayUnitree (UniPwn): one shared key across the fleet — per-device identity absent, so one compromise broke the whole fleet (Alias Robotics)https://lemma.frame00.com/critical/briefs/070-unitree-shared-key-robot-identityhttps://lemma.frame00.com/critical/briefs/070-unitree-shared-key-robot-identityper-device identity absent, so one compromise broke the whole fleet (Alias Robotics)Fri, 19 Jun 2026 00:00:00 GMTPillar 03 Agent Authority ProofIdentity & AuthDJI ROMO: one authenticated client reached 7,000 robot vacuums' cameras — the cloud didn't separate per-device authorization (No Broker ACL)https://lemma.frame00.com/critical/briefs/071-dji-romo-robot-vacuum-no-aclhttps://lemma.frame00.com/critical/briefs/071-dji-romo-robot-vacuum-no-aclthe cloud didn't separate per-device authorization (No Broker ACL)Fri, 19 Jun 2026 00:00:00 GMTPillar 03 Agent Authority ProofIdentity & AuthHugging Face LeRobot: a robotics framework executed untrusted data received over an unauthenticated channel — deserializing (pickle) unverified data leads straight to code execution (CVE-2026-25874)https://lemma.frame00.com/critical/briefs/072-lerobot-pickle-grpc-rcehttps://lemma.frame00.com/critical/briefs/072-lerobot-pickle-grpc-rcedeserializing (pickle) unverified data leads straight to code execution (CVE-2026-25874)Fri, 19 Jun 2026 00:00:00 GMTPillar 03 Agent Authority ProofAgent InfrastructureUniversal Robots PolyScope: unauthenticated network access yields RCE on industrial robots — the robot doesn't verify the commander's authority before physical action (CVE-2026-8153)https://lemma.frame00.com/critical/briefs/068-universal-robots-polyscope-command-injectionhttps://lemma.frame00.com/critical/briefs/068-universal-robots-polyscope-command-injectionthe robot doesn't verify the commander's authority before physical action (CVE-2026-8153)Fri, 19 Jun 2026 00:00:00 GMTPillar 03 Agent Authority ProofIdentity & AuthLiteLLM AI Gateway: from low-privilege user to admin and RCE — authorization not independently verified before action (Obsidian Security)https://lemma.frame00.com/critical/briefs/066-litellm-ai-gateway-privilege-escalationhttps://lemma.frame00.com/critical/briefs/066-litellm-ai-gateway-privilege-escalationauthorization not independently verified before action (Obsidian Security)Fri, 19 Jun 2026 00:00:00 GMTPillar 03 Agent Authority ProofIdentity & AuthSyscoin Bridge: an invalid SPV proof was read as "valid" and minted 5B SYS with no burn — a parsing flaw in SPV proof verificationhttps://lemma.frame00.com/critical/briefs/067-syscoin-bridge-spv-proof-parsinghttps://lemma.frame00.com/critical/briefs/067-syscoin-bridge-spv-proof-parsinga parsing flaw in SPV proof verificationFri, 19 Jun 2026 00:00:00 GMTPillar 01 Verifiable OriginBridge Config TrustShadowMQ: one unsafe pattern (unauthenticated ZMQ + pickle) copied across AI inference frameworks — the same flaw spread at ecosystem scale through reuse (Oligo Security)https://lemma.frame00.com/critical/briefs/073-shadowmq-pickle-zmq-patternhttps://lemma.frame00.com/critical/briefs/073-shadowmq-pickle-zmq-patternthe same flaw spread at ecosystem scale through reuse (Oligo Security)Fri, 19 Jun 2026 00:00:00 GMTPillar 03 Agent Authority ProofAgent InfrastructureWaymo: the robotaxi drove past a stopped school bus — a driving decision not independently verified before a safety-critical actionhttps://lemma.frame00.com/critical/briefs/042-waymo-school-bus-stophttps://lemma.frame00.com/critical/briefs/042-waymo-school-bus-stopa driving decision not independently verified before a safety-critical actionWed, 17 Jun 2026 00:00:00 GMTPillar 02 Verifiable AIAI Decision IntegrityHyundai: driver-assist AI braked on a threat that wasn't there — an AI decision overriding the driver, not independently verified before acting (NHTSA)https://lemma.frame00.com/critical/briefs/061-hyundai-fca-phantom-brakinghttps://lemma.frame00.com/critical/briefs/061-hyundai-fca-phantom-brakingan AI decision overriding the driver, not independently verified before acting (NHTSA)Wed, 17 Jun 2026 00:00:00 GMTPillar 02 Verifiable AIAI Decision IntegrityNHO Hokkaido Hospitals: assumed shredded, sold online — 180,000+ patients' drives slipped through, with no independently verifiable destruction trailhttps://lemma.frame00.com/critical/briefs/065-hokkaido-hospital-hdd-disposalhttps://lemma.frame00.com/critical/briefs/065-hokkaido-hospital-hdd-disposal180,000+ patients' drives slipped through, with no independently verifiable destruction trailWed, 17 Jun 2026 00:00:00 GMTPillar 04 Regulatory Attribute ProofAttribute Proof BypassFrom State Store to RCE — When an AI Agent Trusts Its Own Checkpoint (LangGraph)https://lemma.frame00.com/critical/briefs/058-langgraph-checkpoint-rcehttps://lemma.frame00.com/critical/briefs/058-langgraph-checkpoint-rceWhen an AI Agent Trusts Its Own Checkpoint (LangGraph)Tue, 16 Jun 2026 00:00:00 GMTPillar 03 Agent Authority ProofAgent InfrastructureWhen "Allow All" OAuth to an AI Tool Becomes the Breach Path (Vercel / Context.ai)https://lemma.frame00.com/critical/briefs/059-vercel-contextai-oauthhttps://lemma.frame00.com/critical/briefs/059-vercel-contextai-oauthTue, 16 Jun 2026 00:00:00 GMTPillar 03 Agent Authority ProofAgent InfrastructureBoth Sides Cited Cases That Never Existed — AI-Hallucinated Precedent and Rule 11 Sanctions (N.D. Miss.)https://lemma.frame00.com/critical/briefs/060-withers-aberdeen-ai-hallucinated-precedenthttps://lemma.frame00.com/critical/briefs/060-withers-aberdeen-ai-hallucinated-precedentAI-Hallucinated Precedent and Rule 11 Sanctions (N.D. Miss.)Tue, 16 Jun 2026 00:00:00 GMTPillar 02 Verifiable AIAI Decision IntegrityClaude Code GitHub Action: one issue claiming "[bot]" led the agent to privileged execution — the trigger's authority and input origin not verified before acting (GMO Flatt Security)https://lemma.frame00.com/critical/briefs/062-claude-code-github-action-bot-trusthttps://lemma.frame00.com/critical/briefs/062-claude-code-github-action-bot-trustthe trigger's authority and input origin not verified before acting (GMO Flatt Security)Tue, 16 Jun 2026 00:00:00 GMTPillar 03 Agent Authority ProofAgent InfrastructureSalesloft Drift: a trusted integration's OAuth tokens stolen, hundreds of Salesforce tenants queried — broad, persistent OAuth not scope/revocation-verified per action (UNC6395)https://lemma.frame00.com/critical/briefs/064-salesloft-drift-oauth-salesforcehttps://lemma.frame00.com/critical/briefs/064-salesloft-drift-oauth-salesforcebroad, persistent OAuth not scope/revocation-verified per action (UNC6395)Tue, 16 Jun 2026 00:00:00 GMTPillar 03 Agent Authority ProofAgent InfrastructureBright Data SDK: your living-room TV became a relay node for AI-scraping — the origin and consent of collected data and relayed traffic not independently verified (Include Security)https://lemma.frame00.com/critical/briefs/063-smart-tv-residential-proxy-ai-scrapinghttps://lemma.frame00.com/critical/briefs/063-smart-tv-residential-proxy-ai-scrapingthe origin and consent of collected data and relayed traffic not independently verified (Include Security)Tue, 16 Jun 2026 00:00:00 GMTPillar 01 Verifiable OriginData ProvenanceInternal Data Exfiltrated Without Verifying the Instruction's Origin — EchoLeak in Microsoft 365 Copilot (CVE-2025-32711)https://lemma.frame00.com/critical/briefs/055-echoleak-m365-copilot-instruction-provenancehttps://lemma.frame00.com/critical/briefs/055-echoleak-m365-copilot-instruction-provenanceEchoLeak in Microsoft 365 Copilot (CVE-2025-32711)Mon, 15 Jun 2026 00:00:00 GMTPillar 02 Verifiable AIAI Decision IntegrityNo Check on Who Was Authorized — 64 Million Records Within Reach in McDonald's McHire (Paradox.ai)https://lemma.frame00.com/critical/briefs/056-mchire-paradox-recruiting-authhttps://lemma.frame00.com/critical/briefs/056-mchire-paradox-recruiting-auth64 Million Records Within Reach in McDonald's McHire (Paradox.ai)Mon, 15 Jun 2026 00:00:00 GMTPillar 03 Agent Authority ProofIdentity & AuthReachable Meant Readable — DeepSeek's Unauthenticated ClickHouse Backend Exposurehttps://lemma.frame00.com/critical/briefs/057-deepseek-clickhouse-exposed-dbhttps://lemma.frame00.com/critical/briefs/057-deepseek-clickhouse-exposed-dbDeepSeek's Unauthenticated ClickHouse Backend ExposureMon, 15 Jun 2026 00:00:00 GMTPillar 03 Agent Authority ProofIdentity & AuthGenerated Until the Rightsholder Said No — The Consent-and-Provenance Gap Behind OpenAI Sora 2https://lemma.frame00.com/critical/briefs/054-sora2-ip-provenance-consenthttps://lemma.frame00.com/critical/briefs/054-sora2-ip-provenance-consentThe Consent-and-Provenance Gap Behind OpenAI Sora 2Sat, 13 Jun 2026 00:00:00 GMTPillar 01 Verifiable OriginData ProvenanceServiceNow Scripted REST Endpoint Served Customer Data Without Authenticationhttps://lemma.frame00.com/critical/briefs/046-servicenow-unauthenticated-apihttps://lemma.frame00.com/critical/briefs/046-servicenow-unauthenticated-apiFri, 12 Jun 2026 00:00:00 GMTPillar 03 Agent Authority ProofIdentity & AuthTrapDoor Plants Hidden Directives in AI Assistant Instruction Files Across npm, PyPI, and Crates.iohttps://lemma.frame00.com/critical/briefs/048-trapdoor-ai-instruction-provenancehttps://lemma.frame00.com/critical/briefs/048-trapdoor-ai-instruction-provenanceFri, 12 Jun 2026 00:00:00 GMTPillar 01 Verifiable OriginCode ProvenanceTesla Robotaxi Crash Records — Control Attribution and Narrative Provenance Left Self-Reportedhttps://lemma.frame00.com/critical/briefs/049-tesla-robotaxi-control-attributionhttps://lemma.frame00.com/critical/briefs/049-tesla-robotaxi-control-attributionControl Attribution and Narrative Provenance Left Self-ReportedFri, 12 Jun 2026 00:00:00 GMTPillar 02 Verifiable AIAI Decision IntegrityGenerated Without Consent or Age Verification — The Provenance Gap Behind the Grok Deepfake Controversyhttps://lemma.frame00.com/critical/briefs/050-grok-deepfake-consent-provenancehttps://lemma.frame00.com/critical/briefs/050-grok-deepfake-consent-provenanceThe Provenance Gap Behind the Grok Deepfake ControversyFri, 12 Jun 2026 00:00:00 GMTPillar 04 Regulatory Attribute ProofAttribute Proof BypassAI Agent Forwarded Credentials Before Verifying the Sender (OpenClaw / Varonis)https://lemma.frame00.com/critical/briefs/047-openclaw-agent-phishinghttps://lemma.frame00.com/critical/briefs/047-openclaw-agent-phishingFri, 12 Jun 2026 00:00:00 GMTPillar 02 Verifiable AIAI Decision IntegrityAsking the AI Support Bot Was Enough — Instagram Account Takeovers via Meta High Touch Supporthttps://lemma.frame00.com/critical/briefs/051-instagram-ai-support-takeoverhttps://lemma.frame00.com/critical/briefs/051-instagram-ai-support-takeoverInstagram Account Takeovers via Meta High Touch SupportFri, 12 Jun 2026 00:00:00 GMTPillar 03 Agent Authority ProofIdentity & Auth70,000 Government IDs Leaked to Prove Age — Discord's Third-Party Verification Vendor Breachhttps://lemma.frame00.com/critical/briefs/052-discord-age-verification-id-leakhttps://lemma.frame00.com/critical/briefs/052-discord-age-verification-id-leakDiscord's Third-Party Verification Vendor BreachFri, 12 Jun 2026 00:00:00 GMTPillar 04 Regulatory Attribute ProofAttribute Proof Bypass200 Million Views of Fake Celebrities — The Likeness Provenance Gap Behind YouTube's Deepfake Detectionhttps://lemma.frame00.com/critical/briefs/053-youtube-deepfake-likeness-provenancehttps://lemma.frame00.com/critical/briefs/053-youtube-deepfake-likeness-provenanceThe Likeness Provenance Gap Behind YouTube's Deepfake DetectionFri, 12 Jun 2026 00:00:00 GMTPillar 01 Verifiable OriginData ProvenanceWhen One Laptop Meets the Multisig Threshold — Distributed Approval Collapses to a Single Custody Point (Humanity Protocol)https://lemma.frame00.com/critical/briefs/045-humanity-protocol-multisig-key-custodyhttps://lemma.frame00.com/critical/briefs/045-humanity-protocol-multisig-key-custodyDistributed Approval Collapses to a Single Custody Point (Humanity Protocol)Thu, 11 Jun 2026 00:00:00 GMTPillar 01 Verifiable OriginBridge Config TrustWhen the Assistant Becomes the Trigger — AI Coding Agents Auto-Execute Project-Local Config (SymJack / TrustFall + Miasma)https://lemma.frame00.com/critical/briefs/037-agent-config-auto-executionhttps://lemma.frame00.com/critical/briefs/037-agent-config-auto-executionAI Coding Agents Auto-Execute Project-Local Config (SymJack / TrustFall + Miasma)Tue, 09 Jun 2026 00:00:00 GMTPillar 03 Agent Authority ProofAgent InfrastructureIronWorm — When Stolen Credentials Become Publishing Authority (npm Self-Propagating Implant)https://lemma.frame00.com/critical/briefs/038-ironworm-npm-self-propagationhttps://lemma.frame00.com/critical/briefs/038-ironworm-npm-self-propagationWhen Stolen Credentials Become Publishing Authority (npm Self-Propagating Implant)Tue, 09 Jun 2026 00:00:00 GMTPillar 01 Verifiable OriginCode ProvenanceSemantic Kernel: Prompt Injection Turned Into Host-Level Remote Code Execution — the functions and parameters an agent can call are not authorized or verified before execution (CVE-2026-25592 / CVE-2026-26030)https://lemma.frame00.com/critical/briefs/039-semantic-kernel-prompt-injection-rcehttps://lemma.frame00.com/critical/briefs/039-semantic-kernel-prompt-injection-rcethe functions and parameters an agent can call are not authorized or verified before execution (CVE-2026-25592 / CVE-2026-26030)Tue, 09 Jun 2026 00:00:00 GMTPillar 03 Agent Authority ProofAgent InfrastructurePhantom Carbon Credits — When an Environmental Attribute Is Issued Without Independent Verification of Its Underlying Data (Operation Greenwashing)https://lemma.frame00.com/critical/briefs/040-redd-carbon-credit-phantom-issuancehttps://lemma.frame00.com/critical/briefs/040-redd-carbon-credit-phantom-issuanceWhen an Environmental Attribute Is Issued Without Independent Verification of Its Underlying Data (Operation Greenwashing)Tue, 09 Jun 2026 00:00:00 GMTPillar 04 Regulatory Attribute ProofAttribute Proof BypassAOG Technics: over 60,000 aircraft engine parts circulated with forged airworthiness certificates — the provenance of the certificates asserting airworthiness is not independently verified before receipt (SFO)https://lemma.frame00.com/critical/briefs/041-aog-technics-forged-airworthiness-certificateshttps://lemma.frame00.com/critical/briefs/041-aog-technics-forged-airworthiness-certificatesthe provenance of the certificates asserting airworthiness is not independently verified before receipt (SFO)Tue, 09 Jun 2026 00:00:00 GMTPillar 04 Regulatory Attribute ProofAttribute Proof BypassSelf-Reported Autonomous-Driving Safety, Unverified — Tesla FSD Crash Data and Safety-Stat Methodologyhttps://lemma.frame00.com/critical/briefs/043-tesla-fsd-self-reported-safetyhttps://lemma.frame00.com/critical/briefs/043-tesla-fsd-self-reported-safetyTesla FSD Crash Data and Safety-Stat MethodologyTue, 09 Jun 2026 00:00:00 GMTPillar 02 Verifiable AIAI Decision IntegrityAI Agents Drove Intrusions From Initial Access to Exfiltration — Signature-Based Detection Cannot Track Tooling the AI Generates Per Target (SHADOW-AETHER-040 / 064)https://lemma.frame00.com/critical/briefs/031-vibe-hacking-shadow-aetherhttps://lemma.frame00.com/critical/briefs/031-vibe-hacking-shadow-aetherSignature-Based Detection Cannot Track Tooling the AI Generates Per Target (SHADOW-AETHER-040 / 064)Mon, 08 Jun 2026 00:00:00 GMTPillar 03 Agent Authority ProofAgent RunawayInside a Legitimate Booking Platform, the Payout Bank Account Was Silently Rewritten — The Change Was Not Independently Verified Before Funds Moved (Polaris Holdings / Booking.com)https://lemma.frame00.com/critical/briefs/032-booking-payout-account-tamperinghttps://lemma.frame00.com/critical/briefs/032-booking-payout-account-tamperingThe Change Was Not Independently Verified Before Funds Moved (Polaris Holdings / Booking.com)Mon, 08 Jun 2026 00:00:00 GMTPillar 04 Regulatory Attribute ProofAttribute Proof BypassOne Edge Appliance Compromise Cascaded to Full Domain Takeover — An Implicitly Trusted F5 BIG-IP Became the Pivot, Along With the Credentials It Storedhttps://lemma.frame00.com/critical/briefs/033-f5-bigip-edge-pivothttps://lemma.frame00.com/critical/briefs/033-f5-bigip-edge-pivotAn Implicitly Trusted F5 BIG-IP Became the Pivot, Along With the Credentials It StoredMon, 08 Jun 2026 00:00:00 GMTPillar 03 Agent Authority ProofIdentity & AuthLive Biometric Verification Defeated by an Injected Video Feed — KYC Believed It Had Captured a Live Person, But the Provenance of the Capture Was Never Verifiedhttps://lemma.frame00.com/critical/briefs/034-ekyc-liveness-bypasshttps://lemma.frame00.com/critical/briefs/034-ekyc-liveness-bypassKYC Believed It Had Captured a Live Person, But the Provenance of the Capture Was Never VerifiedMon, 08 Jun 2026 00:00:00 GMTPillar 04 Regulatory Attribute ProofAttribute Proof BypassThe Inspections Were Recorded as 'Complete' — But Never Performed. On the Boeing 787, the Existence of a Record Was Mistaken for Proof of the Acthttps://lemma.frame00.com/critical/briefs/035-boeing-787-inspection-recordshttps://lemma.frame00.com/critical/briefs/035-boeing-787-inspection-recordsBut Never Performed. On the Boeing 787, the Existence of a Record Was Mistaken for Proof of the ActMon, 08 Jun 2026 00:00:00 GMTPillar 04 Regulatory Attribute ProofAttribute Proof Bypass12.8 Billion Training Images Contained Passports, Résumés, and Faces — The Provenance and Consent of Training Data Were Never Verified at Collectionhttps://lemma.frame00.com/critical/briefs/036-commonpool-training-data-piihttps://lemma.frame00.com/critical/briefs/036-commonpool-training-data-piiThe Provenance and Consent of Training Data Were Never Verified at CollectionMon, 08 Jun 2026 00:00:00 GMTPillar 01 Verifiable OriginTraining Data ProvenanceOne-Click GitHub OAuth Token Theft via github.dev — The Webview Trusted Synthetic Events, and the Token Was Not Scoped to the Repohttps://lemma.frame00.com/critical/briefs/029-github-dev-oauth-tokenhttps://lemma.frame00.com/critical/briefs/029-github-dev-oauth-tokenThe Webview Trusted Synthetic Events, and the Token Was Not Scoped to the RepoSat, 06 Jun 2026 00:00:00 GMTPillar 03 Agent Authority ProofAgent InfrastructureStripe's Trusted API Infrastructure Repurposed to Deliver Card-Skimming Code and Store Stolen Data — Allowlists Trust the Domain's Identity, Not the Provenance of What It Carrieshttps://lemma.frame00.com/critical/briefs/030-stripe-trusted-channel-skimmerhttps://lemma.frame00.com/critical/briefs/030-stripe-trusted-channel-skimmerAllowlists Trust the Domain's Identity, Not the Provenance of What It CarriesSat, 06 Jun 2026 00:00:00 GMTPillar 01 Verifiable OriginCode ProvenanceMCP Design: Config-to-Command Execution and Supply-Chain-Scale RCE — Not a single-language implementation bug but inherent in the reference SDK design across supported languageshttps://lemma.frame00.com/critical/briefs/025-mcp-stdio-config-to-command-rcehttps://lemma.frame00.com/critical/briefs/025-mcp-stdio-config-to-command-rceNot a single-language implementation bug but inherent in the reference SDK design across supported languagesFri, 05 Jun 2026 00:00:00 GMTPillar 03 Agent Authority ProofAgent InfrastructureThe Alephium TokenBridge Exploit ($815K) — Guardian Keys Intact, But No Verification of the Provenance of the Events They Signedhttps://lemma.frame00.com/critical/briefs/023-alephium-tokenbridgehttps://lemma.frame00.com/critical/briefs/023-alephium-tokenbridgeGuardian Keys Intact, But No Verification of the Provenance of the Events They SignedFri, 05 Jun 2026 00:00:00 GMTPillar 01 Verifiable OriginBridge Config TrustAdaptive AI Worm — Runtime Exploit Synthesis as a Threat Modelhttps://lemma.frame00.com/critical/briefs/026-adaptive-ai-worm-runtime-exploithttps://lemma.frame00.com/critical/briefs/026-adaptive-ai-worm-runtime-exploitRuntime Exploit Synthesis as a Threat ModelFri, 05 Jun 2026 00:00:00 GMTPillar 03 Agent Authority ProofAgent RunawayInvisible Unicode Instruction Injection — The Gap Between Human-Read and Model-Read Inputhttps://lemma.frame00.com/critical/briefs/024-invisible-unicode-instruction-injectionhttps://lemma.frame00.com/critical/briefs/024-invisible-unicode-instruction-injectionThe Gap Between Human-Read and Model-Read InputFri, 05 Jun 2026 00:00:00 GMTPillar 02 Verifiable AIAI Decision IntegrityLibreChat CVE-2026-32625 — User-Supplied MCP Server URLs as an Exfiltration Channel for Server Secretshttps://lemma.frame00.com/critical/briefs/027-librechat-mcp-url-secretshttps://lemma.frame00.com/critical/briefs/027-librechat-mcp-url-secretsUser-Supplied MCP Server URLs as an Exfiltration Channel for Server SecretsFri, 05 Jun 2026 00:00:00 GMTPillar 03 Agent Authority ProofAgent InfrastructureThe npm Dependency-Confusion Recon Campaign — 33 Packages Impersonating Internal Scopes Exploit the Build Environment's Provenance Assumptionshttps://lemma.frame00.com/critical/briefs/028-npm-dependency-confusion-reconhttps://lemma.frame00.com/critical/briefs/028-npm-dependency-confusion-recon33 Packages Impersonating Internal Scopes Exploit the Build Environment's Provenance AssumptionsFri, 05 Jun 2026 00:00:00 GMTPillar 01 Verifiable OriginCode ProvenanceOnlyFake — AI-Generated IDs Bypass Exchange KYChttps://lemma.frame00.com/critical/briefs/022-onlyfake-ai-id-kyc-bypasshttps://lemma.frame00.com/critical/briefs/022-onlyfake-ai-id-kyc-bypassAI-Generated IDs Bypass Exchange KYCThu, 04 Jun 2026 00:00:00 GMTPillar 04 Regulatory Attribute ProofAttribute Proof BypassUnqualified Engineers Placed Under National-License Claims — Regulatory Attributes Asserted Without Independent Verification at the Point of Assignmenthttps://lemma.frame00.com/critical/briefs/019-construction-engineer-qualification-fraudhttps://lemma.frame00.com/critical/briefs/019-construction-engineer-qualification-fraudRegulatory Attributes Asserted Without Independent Verification at the Point of AssignmentWed, 03 Jun 2026 00:00:00 GMTPillar 04 Regulatory Attribute ProofAttribute Proof BypassTampered Certification Test Data Behind Type Designation — Product Regulatory-Conformance Attributes Asserted Without Independent Verification on the Path to Shipmenthttps://lemma.frame00.com/critical/briefs/020-type-designation-conformity-fraudhttps://lemma.frame00.com/critical/briefs/020-type-designation-conformity-fraudProduct Regulatory-Conformance Attributes Asserted Without Independent Verification on the Path to ShipmentWed, 03 Jun 2026 00:00:00 GMTPillar 04 Regulatory Attribute ProofAttribute Proof BypassWirecard: forged bank balance confirmations asserted €1.9B that didn't exist — a financial attribute disclosed without independent verificationhttps://lemma.frame00.com/critical/briefs/021-wirecard-balance-attestationhttps://lemma.frame00.com/critical/briefs/021-wirecard-balance-attestationa financial attribute disclosed without independent verificationWed, 03 Jun 2026 00:00:00 GMTPillar 04 Regulatory Attribute ProofAttribute Proof BypassGTG-1002: AI agent autonomously executed 80–90% of a cyberattack — first reported AI-orchestrated espionage, agent authority never independently verifiedhttps://lemma.frame00.com/critical/briefs/009-gtg1002-ai-orchestrated-espionagehttps://lemma.frame00.com/critical/briefs/009-gtg1002-ai-orchestrated-espionagefirst reported AI-orchestrated espionage, agent authority never independently verifiedSun, 31 May 2026 00:00:00 GMTPillar 03 Agent Authority ProofAgent RunawayClaude Code Source-Leak Lures — Weaponizing Trust Signals and GitHub Releases as a Provenance-Spoofed Delivery Channelhttps://lemma.frame00.com/critical/briefs/010-claude-code-leak-lurehttps://lemma.frame00.com/critical/briefs/010-claude-code-leak-lureWeaponizing Trust Signals and GitHub Releases as a Provenance-Spoofed Delivery ChannelSun, 31 May 2026 00:00:00 GMTPillar 01 Verifiable OriginCode ProvenanceThe Robert Williams Wrongful Arrest — When an AI Face-Match Drove a Government Enforcement Action Without Independent Verificationhttps://lemma.frame00.com/critical/briefs/012-williams-frt-wrongful-arresthttps://lemma.frame00.com/critical/briefs/012-williams-frt-wrongful-arrestWhen an AI Face-Match Drove a Government Enforcement Action Without Independent VerificationSun, 31 May 2026 00:00:00 GMTPillar 02 Verifiable AIAI Bias / HarmThe Coinbase KYC Insider Breach — When Regulation-Mandated Storage of Raw PII Becomes the Breach Surfacehttps://lemma.frame00.com/critical/briefs/013-coinbase-kyc-insider-breachhttps://lemma.frame00.com/critical/briefs/013-coinbase-kyc-insider-breachWhen Regulation-Mandated Storage of Raw PII Becomes the Breach SurfaceSun, 31 May 2026 00:00:00 GMTPillar 04 Regulatory Attribute ProofKYC / AML DisclosureThe TanStack npm Compromise — Malicious Packages Signed Under a Legitimate OIDC Trusted Publisher, Where a Valid Provenance Signature Did Not Mean a Trustworthy Artifacthttps://lemma.frame00.com/critical/briefs/014-tanstack-oidc-trusted-publisherhttps://lemma.frame00.com/critical/briefs/014-tanstack-oidc-trusted-publisherMalicious Packages Signed Under a Legitimate OIDC Trusted Publisher, Where a Valid Provenance Signature Did Not Mean a Trustworthy ArtifactSun, 31 May 2026 00:00:00 GMTPillar 01 Verifiable OriginCode ProvenanceThe GitHub Internal Repository Breach — A Poisoned VS Code Extension, Live for 18 Minutes, Exploited the Developer Trust Surfacehttps://lemma.frame00.com/critical/briefs/015-github-vscode-extension-breachhttps://lemma.frame00.com/critical/briefs/015-github-vscode-extension-breachA Poisoned VS Code Extension, Live for 18 Minutes, Exploited the Developer Trust SurfaceSun, 31 May 2026 00:00:00 GMTPillar 01 Verifiable OriginCode ProvenanceSynthID Watermark, Statistically Stripped — a provenance mark that can be removed and forged (Google DeepMind / Alosh Denny)https://lemma.frame00.com/critical/briefs/011-synthid-watermark-reverse-engineeringhttps://lemma.frame00.com/critical/briefs/011-synthid-watermark-reverse-engineeringa provenance mark that can be removed and forged (Google DeepMind / Alosh Denny)Sun, 31 May 2026 00:00:00 GMTPillar 01 Verifiable OriginData ProvenanceMcKinsey Lilli's Writable System Prompts — The Layer Governing the AI's Behavior Had No Integrity or Provenancehttps://lemma.frame00.com/critical/briefs/017-mckinsey-lilli-system-promptshttps://lemma.frame00.com/critical/briefs/017-mckinsey-lilli-system-promptsThe Layer Governing the AI's Behavior Had No Integrity or ProvenanceSun, 31 May 2026 00:00:00 GMTPillar 02 Verifiable AIAI Decision IntegrityThe Verus-Ethereum Bridge Hack ($11.58M) — A Valid Merkle Proof, But No Verification That the Source Amount Matched the Payouthttps://lemma.frame00.com/critical/briefs/016-verus-ethereum-bridgehttps://lemma.frame00.com/critical/briefs/016-verus-ethereum-bridgeA Valid Merkle Proof, But No Verification That the Source Amount Matched the PayoutSun, 31 May 2026 00:00:00 GMTPillar 01 Verifiable OriginBridge Config TrustThe hackerbot-claw Campaign's First Recorded AI-vs-AI Attack — Weaponizing a Repository's CLAUDE.md to Hijack the Defending AI Agent's Instructionshttps://lemma.frame00.com/critical/briefs/018-hackerbot-claw-ai-vs-aihttps://lemma.frame00.com/critical/briefs/018-hackerbot-claw-ai-vs-aiWeaponizing a Repository's CLAUDE.md to Hijack the Defending AI Agent's InstructionsSun, 31 May 2026 00:00:00 GMTPillar 02 Verifiable AIAI Decision IntegrityStarlette CVE-2026-48710 (BadHost) — MCP Server Authentication Bypass via HTTP Host Header Manipulationhttps://lemma.frame00.com/critical/briefs/003-starlette-badhosthttps://lemma.frame00.com/critical/briefs/003-starlette-badhostMCP Server Authentication Bypass via HTTP Host Header ManipulationSat, 30 May 2026 00:00:00 GMTPillar 03 Agent Authority ProofAgent InfrastructureMegalodon GitHub Supply Chain — CI/CD Credential-Theft Campaign That Poisoned 5,561 Repositories in 6 Hourshttps://lemma.frame00.com/critical/briefs/004-megalodon-github-supply-chainhttps://lemma.frame00.com/critical/briefs/004-megalodon-github-supply-chainCI/CD Credential-Theft Campaign That Poisoned 5,561 Repositories in 6 HoursSat, 30 May 2026 00:00:00 GMTPillar 01 Verifiable OriginCode ProvenanceNoroboto: embedded "lying fonts" made AI's document review read different text — input-integrity forgeryhttps://lemma.frame00.com/critical/briefs/005-noroboto-lying-fontshttps://lemma.frame00.com/critical/briefs/005-noroboto-lying-fontsinput-integrity forgerySat, 30 May 2026 00:00:00 GMTPillar 02 Verifiable AIAI Decision IntegrityCursor + Claude Opus 4.6 Wiped PocketOS Production DB in 9 Seconds — The Unverified Destructive Authority of AI Coding Agentshttps://lemma.frame00.com/critical/briefs/007-pocketos-cursor-db-deletionhttps://lemma.frame00.com/critical/briefs/007-pocketos-cursor-db-deletionThe Unverified Destructive Authority of AI Coding AgentsSat, 30 May 2026 00:00:00 GMTPillar 03 Agent Authority ProofAgent RunawayDiscord 2.05 Billion Message Scraping via Public API — How Public Channel Data Gets Redistributed as AI Training Datasetshttps://lemma.frame00.com/critical/briefs/008-discord-scrapinghttps://lemma.frame00.com/critical/briefs/008-discord-scrapingHow Public Channel Data Gets Redistributed as AI Training DatasetsSat, 30 May 2026 00:00:00 GMTPillar 01 Verifiable OriginTraining Data ProvenanceGoogle API Keys Remain Usable for 23 Minutes After Deletion — Independent Verification Gap in Credential Revocation Attributeshttps://lemma.frame00.com/critical/briefs/006-google-api-key-revocation-laghttps://lemma.frame00.com/critical/briefs/006-google-api-key-revocation-lagIndependent Verification Gap in Credential Revocation AttributesSat, 30 May 2026 00:00:00 GMTPillar 04 Regulatory Attribute ProofAttribute Proof BypassKelpDAO / rsETH Unauthorized Unlock — RPC Manipulation Attack on the DVN Observation Layerhttps://lemma.frame00.com/critical/briefs/001-kelpdao-rsethhttps://lemma.frame00.com/critical/briefs/001-kelpdao-rsethRPC Manipulation Attack on the DVN Observation LayerFri, 29 May 2026 00:00:00 GMTPillar 01 Verifiable OriginBridge Config TrustStake DAO vsdCRV Unauthorized Mint — LayerZero v2 Trust Source Rewriting via Deployer Keyhttps://lemma.frame00.com/critical/briefs/002-stakedao-vsdcrvhttps://lemma.frame00.com/critical/briefs/002-stakedao-vsdcrvLayerZero v2 Trust Source Rewriting via Deployer KeyFri, 29 May 2026 00:00:00 GMTPillar 01 Verifiable OriginBridge Config Trust