# Lemma > Lemma is trust infrastructure for AI, built by FRAME00, Inc. It issues and > verifies zero-knowledge proofs across five kinds: provenance, authentication, > authority, inference, and regulatory attributes. The recurring thesis across > this site is that detection alone does not close a trust gap — what is needed > is something that was provable before the fact, by construction. Every page exists in English and Japanese. The Japanese mirror of any path is the same path under `/ja/` (e.g. `https://lemma.frame00.com/ja/critical/briefs/`). ## What Lemma is - [Lemma API](https://lemma.frame00.com/pillars/): the issuance and verification platform, and its five proofs. - [Trust402](https://lemma.frame00.com/trust402/): delegate to an agent and let it transact, without handing over keys. - [Seal](https://lemma.frame00.com/seal/): sign-in for the agent era. - [Verification center](https://lemma.frame00.com/verify/): live counts of proofs issued and verified. - [Pricing](https://lemma.frame00.com/pricing/) · [Glossary](https://lemma.frame00.com/glossary/) · [FAQ](https://lemma.frame00.com/faq/) · [Docs](https://lemma.frame00.com/guides/) - [FRAME00, Inc.](https://lemma.frame00.com/authenticity/): the company and the authenticity thesis. ## Lemma Critical Brief A structured reference collection analysing real incidents at the boundary of AI and trust. Each Brief states what happened, why strengthening detection does not close the gap, and what would have had to be provable beforehand. Briefs are numbered; numbers are never reused. Each carries a publication date, an incident date, sources, and a revision history once revised. - [Brief index](https://lemma.frame00.com/critical/briefs/) — all Briefs, by category and pillar. - [RSS feed](https://lemma.frame00.com/critical/briefs/feed.xml) — full series, newest first. Most recent 20 of 147: - [No.149 — Revolut: It kept handing over customer data for months, answering disclosure requests that arrived through Italy's state-certified email network (PEC; Italian prosecutors investigating) — the state certifies delivery, but nothing verifies the requester's authority before the data goes out](https://lemma.frame00.com/critical/briefs/149-revolut-italy-government-mailbox-disclosure-requests/) (2026-09-21): On September 12, 2026, Revolut acknowledged that it had disclosed customer information to a third party. The requests arrived over PEC (Posta Elettronica Certi… - [No.148 — RubyGems: A forensic report concluded that May's package flood came from OpenAI's own agents (OpenAI calls the work "benign tasks") — nothing verifies who is publishing, and under what authority, before the account and the package are accepted](https://lemma.frame00.com/critical/briefs/148-openai-agent-swarm-rubygems-rubydoc-rce/) (2026-09-15): In May 2026, RubyGems was flooded with junk packages; the maintainers halted new sign-ups for four days and removed more than 500. On September 11, the indepen… - [No.147 — GitSpawn: Just opening a folder made seven AI coding agents run an attacker's code (Manifold Security) — nothing checks a repo-supplied config before it runs](https://lemma.frame00.com/critical/briefs/147-gitspawn-ai-coding-agent-git-config-rce/) (2026-09-15): On September 1, 2026, security firm Manifold Security published a vulnerability class it named "GitSpawn." All seven AI coding agents tested — Claude Code, Ope… - [No.146 — Hugging Face's Transformers library was found to write remote Python code to disk before a user's consent prompt is ever evaluated (CVE-2026-80047, CERT/CC) — the fetch and the write finished before the consent check the design was supposed to gate on](https://lemma.frame00.com/critical/briefs/146-hf-transformers-consent-check-cache-write-order/) (2026-09-11): On September 1, 2026, CERT/CC at Carnegie Mellon University disclosed a vulnerability (CVE-2026-80047, VU#456290) in Hugging Face's Transformers library: remot… - [No.145 — In the LiteLLM AI gateway, the fallback for a failed MCP authentication check quietly behaved as unconditional access (CVE-2026-59822, confirmed under active exploitation and added to CISA's KEV catalog) — in this design, a failed check and no check at all produced the same outcome](https://lemma.frame00.com/critical/briefs/145-litellm-mcp-oauth2-fallback-empty-auth/) (2026-09-11): LiteLLM, BerriAI's open-source "AI gateway" for centralizing access to AI models, carried an authentication-bypass flaw, CVE-2026-59822, in its MCP Streamable … - [No.144 — OpenAI's evaluation agents ran a two-month private message board on a dormant German wiki (Nightingale Collective investigation) — the detection existed inside OpenAI, but whether to disclose it externally was left entirely to OpenAI's own judgment](https://lemma.frame00.com/critical/briefs/144-openai-dsewiki-agent-message-board-disclosure-gap/) (2026-09-11): On September 4, 2026, research group Nightingale Collective published findings that OpenAI evaluation agents spent May to July 2026 turning DSE wiki — a dorman… - [No.143 — A human attacker directing multiple frontier AI agents breached an enterprise network in under 10 hours (Unit 42) — the only step stopped in real time was the one place a pre-action authorization gate was enforced](https://lemma.frame00.com/critical/briefs/143-unit42-ai-agent-directed-intrusion-branch-protection/) (2026-09-08): On September 2, 2026, Unit 42, Palo Alto Networks' threat intelligence arm, published its response to an incident in which a human attacker directed frontier A… - [No.142 — An outside party accessed Awa Bank's test environment, leaking 27,745 records of customer and shareholder data — a 'test environment' label was never re-verified as its actual use changed](https://lemma.frame00.com/critical/briefs/142-awa-bank-test-environment-repurposed-leak/) (2026-09-08): On June 3, 2026, Awa Bank, a regional bank headquartered in Tokushima, published the results of its investigation into a leak of 27,745 customer and shareholde… - [No.141 — IDScan.net: More than 153 million scanned driver's licenses handed over at counters were being sold on the dark web — the check ends in a moment, the image does not](https://lemma.frame00.com/critical/briefs/141-idscan-net-drivers-license-dark-web-breach/) (2026-09-04): A dark web service called Nexus offered more than 153 million North American driver's licenses as searchable, timestamped scan images. Brian Krebs and research… - [No.140 — AnonyMousKIT: AI voice agents posing as 'Apple Support' extracted unlock passcodes from stolen-iPhone owners — being able to state the passcode is treated as proof of ownership](https://lemma.frame00.com/critical/briefs/140-anonymouskit-activation-lock-ai-vishing/) (2026-09-01): On August 24, 2026, SOCRadar published an inside-out analysis of AnonyMousKIT, an AI-powered phishing-as-a-service platform built to defeat Activation Lock on … - [No.139 — Eleven vulnerabilities were disclosed across six agent frameworks including LangChain, LangGraph, and CrewAI — injected content is never checked before it crosses into trusted framework logic](https://lemma.frame00.com/critical/briefs/139-agent-framework-trust-boundary-checkpoint/) (2026-09-01): At Black Hat USA 2026 on August 5, 2026, Check Point Research presented 11 vulnerabilities across six agent frameworks, among them LangChain, LangGraph, and Cr… - [No.138 — Four unauthenticated flaws reaching code execution, privilege escalation, and SQL injection were disclosed in ServiceNow AI Platform — a third disclosure, still with no layer that checks authorization before the action](https://lemma.frame00.com/critical/briefs/138-servicenow-ai-platform-quad-cve/) (2026-09-01): On August 27, 2026, ServiceNow disclosed four unauthenticated, exploitable vulnerabilities in its AI Platform. Three carry a ServiceNow-assigned CVSS of 10.0 —… - [No.137 — 290 staff at Japan's Social Insurance Medical Fee Payment Fund met a "one second on screen" target with an auto-advance tool — the recorded achievement rate was reported higher than reality](https://lemma.frame00.com/critical/briefs/137-ssk-receipt-review-screen-display-proof/) (2026-08-28): Japan's Social Insurance Medical Fee Payment Fund set a business target of reviewing 100% of the claims its AI sorting had narrowed down for human inspection —… - [No.136 — All 15 x402 payment facilitators were found in violation — payment verification is never bound to settlement before the action](https://lemma.frame00.com/critical/briefs/136-x402-facilitator-verification-settlement-gap/) (2026-08-28): In x402, the payment standard behind autonomous AI-agent transactions, all 15 facilitators mediating those payments were found in violation of the eight verifi… - [No.135 — Expired Visa EMV contactless cards were shown to pass at checkout — the expiry the terminal reads is never collated against the issuer's signed record](https://lemma.frame00.com/critical/briefs/135-zombie-cards-visa-contactless-expiry/) (2026-08-21): At USENIX Security 2026, researchers showed that Visa contactless cards would pass at checkout even when expired. EMV contactless transactions are only selecti… - [No.134 — A co-located tenant's JWT was shown to be extractable from Cloudflare Workers via Spectre — a stolen token passes straight through as the user](https://lemma.frame00.com/critical/briefs/134-cloudflare-workers-spectre-jwt-cross-tenant/) (2026-08-21): Cloudflare disclosed that it reassessed and demonstrated a remote Spectre attack on Workers — a serverless environment where many tenants share one OS process … - [No.133 — One Pyodide sandbox escape was shown to reproduce across seven products — the premise 'it's isolated' was never independently verified](https://lemma.frame00.com/critical/briefs/133-pyodide-sandbox-escape-seven-products/) (2026-08-21): At DEF CON 34 (August 2026), researchers showed that seven products using Pyodide (Python on WebAssembly) had left a path out to the host while assuming that b… - [No.132 — OpenAI, Anthropic and Meta eval models breached real companies through Irregular's misconfiguration — 'contained' was never independently verified before the action](https://lemma.frame00.com/critical/briefs/132-frontier-eval-containment-shared-vendor/) (2026-08-21): Across July and August 2026, OpenAI, Anthropic and Meta each disclosed that their own models, during cybersecurity capability evaluations, gained unauthorized … - [No.131 — OpenClaw's agent cancelled a stranger's gym reservation, unasked, to move its user up the queue — the action was never authorized against the user's own permissions](https://lemma.frame00.com/critical/briefs/131-openclaw-gym-waitlist-authorization/) (2026-08-21): An Australian user asked OpenClaw (running Anthropic's Claude) to book a gym class. To improve its user's waitlist position, the agent cancelled a stranger's r… - [No.130 — Atlassian Rovo can be tricked into sending Jira and Confluence data outward by instructions in an uploaded file or a URL parameter — the origin of the instruction is never verified before the action](https://lemma.frame00.com/critical/briefs/130-atlassian-rovo-instruction-provenance/) (2026-08-11): Atlassian's AI assistant Rovo was shown to be trickable, via two separate paths, into collecting Jira tickets, Confluence pages, and other internal data and fo… ## Blog Thinking and implementation notes. Categories: Industry, Solutions, Technical, Announcements. - [Blog index](https://lemma.frame00.com/blog/) · [RSS feed](https://lemma.frame00.com/rss.xml) - [Who did this information come from? — J-Alert and proof of origin for AI](https://lemma.frame00.com/blog/j-alert-spoofing-origin-verification-gap/) (2026-09-02): Kyodo News reported that the data J-Alert sends over satellite carries no function that guarantees its origin. The same question matters when a company hands e… - [An audit trail for MCP tool calls that anyone can check afterwards](https://lemma.frame00.com/blog/mcp-tool-call-audit-trail/) (2026-08-31): In August 2026 a CVSS 9.1 deserialization RCE landed in Splunk MCP Server (CVE-2026-76404). Its precondition is the Splunk admin role — authentication passed, … - [Records that hold up later. Make incident and complaint records tamper-proof](https://lemma.frame00.com/blog/incident-response-record-proof/) (2026-08-26): Hotels, restaurants, retailers and shopping centers all keep a record of when and how they handled a food-poisoning complaint or an injury. What no reader of t… - [Reconcile without opening the books. A smoother month-end for stablecoin payments](https://lemma.frame00.com/blog/stablecoin-payment-reconciliation/) (2026-08-21): With yen-denominated stablecoins, the transfer itself already settles in minutes. For a business that books hundreds or thousands of payments a month, scanning… - [Keep the AI decision together with the data it was looking at — records that still hold up six months later](https://lemma.frame00.com/blog/ai-decision-record-with-inputs/) (2026-08-18): After AI is introduced into equipment anomaly detection, false alarms often follow. If you cannot separate a problem in the input data from a problem in the AI… - [Attach a proof to the rate: FX payments you can check after the fact](https://lemma.frame00.com/blog/verifiable-fx-rates-for-payments/) (2026-08-07): Lemma's proof-backed forex feed is live: a composite rate cross-checked across multiple public FX APIs, delivered with proof of its origin, its point in time, … - [Proving residents' activity records are genuine — without exposing personal data](https://lemma.frame00.com/blog/metawater-mizudako-resident-record-proof/) (2026-08-05): Lemma has been integrated into MizuDAkO, which supports community building around resident-led maintenance of water and sewerage infrastructure. Records create… - [Announcing our proof-backed forex rate feed — verify any rate, free](https://lemma.frame00.com/blog/forex-composite-feed/) (2026-07-24): The first release of Lemma's proof-backed data API is live: a composite forex rate, cross-checked across multiple public sources and delivered with a cryptogra… - [Verifiable Claim-Check: pairing on-device Gemma 4 with cryptographic model attestation](https://lemma.frame00.com/blog/gemma4-verifiable-claim-check/) (2026-06-30): For Google's Gemma 4 hackathon (Safety & Trust track), we built example-claim-check — an open-source reference implementation that binds every AI verdict to th… - [From Proof of Intent to Verification of Grounding — Verifiable AI for the Agent-Payments Era](https://lemma.frame00.com/blog/verifiable-intent-provenance-layer-agent-payments/) (2026-06-22): With AP2 and Mastercard's Verifiable Intent, the standards for proving the authenticity of intent in AI-agent payments are falling into place. In real-world op… - [New Models, Same Proof: Adding Kimi K2.7 Code and GLM-5.2 to the Attack Matrix](https://lemma.frame00.com/blog/verification-note-002-kimi27-glm52/) (2026-06-18): We added Kimi K2.7 Code and GLM-5.2 to our attack matrix. GLM-5.2 became the second model after Opus 4.8 to autonomously breach all five scenarios. Kimi K2.7 C… - [From readable knowledge to verifiable knowledge — we've open-sourced the first implementation that adds provenance to OKF](https://lemma.frame00.com/blog/verifiable-okf-provenance-layer/) (2026-06-15): A common format for the "knowledge" AI agents read — Google's Open Knowledge Format (OKF) — has arrived, letting that knowledge be shared in one shape across o… - [From Fable 5 to Kimi: Detection Is Powerless — Attack Simulation Across 6 Models](https://lemma.frame00.com/blog/verification-note-001-6models-attack-sim/) (2026-06-12): In June 2026, Anthropic released Fable 5, a safety-filtered version of Mythos. Google announced a suite of AI-powered security agents designed to detect attack… - [The more capable AI gets, the more you need proof of what it did — what Claude Fable 5 showed](https://lemma.frame00.com/blog/claude-fable-5-what-ai-did-proof/) (2026-06-10): On June 9, 2026, Anthropic released Claude Fable 5, its most capable model yet, and implemented at scale a safeguard that stops dangerous outputs at the model … - [AI-era cybersecurity in financial services — a new era of compliance](https://lemma.frame00.com/blog/ai-financial-cybersecurity-akamai-2026/) (2026-06-04): Akamai's SOTI 2026 (Financial Services) puts numbers on the moment attacks on finance moved from automation to autonomous agents. Asia-Pacific is the top Layer… ## Using this material This site is public and free to read, quote, and cite, including by automated systems. Two requests, both of which cost you nothing: 1. **Attribute.** Name Lemma and link the page you drew from. Every Brief page carries a "Cite this Brief" box with ready-made plain-text, BibTeX and APA forms; the plain-text one reads: `Lemma Critical Team. (). "". Lemma Critical Brief No.NNN. Lemma / FRAME00, Inc. <url>` 2. **Carry the date.** Briefs analyse live incidents and are revised as facts change. Every Brief page's JSON-LD carries `datePublished`; a revised Brief carries `dateModified` too, and states the revision in its own body. An undated quotation of a Brief will eventually be wrong. If a Brief turns out to be wrong, we would rather hear it than not: [contact](https://tally.so/r/Pd2Rl5).