{"_canonicalization":{"envelope_id":"axm_ + sha256(envelope minus {signature, axiom_id, anchors})","envelope_signature":"ed25519(envelope minus {signature, axiom_id})","json":"sort_keys=True, separators=(',',':'), ensure_ascii=False, allow_nan=False, utf-8","leaf_hash":"sha256(0x00 || canonical_json(envelope_full))","seal_signature":"ed25519(seal minus {signature, sig_algorithm})"},"axiom_id":"axm_401b722a34ea7fb9ec12a700831155b25a4da07e979c310a3bd0ceaa74b78e77","bitcoin_anchor":{"bitcoin_attestations":[],"calendar_attestations":[],"ots_url":"","stamped_at":"","status":"pending_next_stamp"},"envelope":{"anchors":[{"chain":"crovia.axiom_graph","height":0,"merkle_proof":"spider_vendor_press_v1","root_at_anchor":"spider_vendor_press_v1"}],"axiom_id":"axm_401b722a34ea7fb9ec12a700831155b25a4da07e979c310a3bd0ceaa74b78e77","axiom_type":"AX.OBS","body":{"axiom_subtype":"news.vendor_press.v1","category":"news","fingerprint":"f855c341c19836cb8f64de5103e41c1af183dc65cd7879d22d937bb4fc123fe3","published":"Thu, 16 Jul 2026 00:00:00 -0400","receipt_hash":"f855c341c19836cb8f64de5103e41c1af183dc65cd7879d22d937bb4fc123fe3","schema":"spider.news.vendor_press.v1","spider":"vendor_press","spider_record":{"axiom_subtype":"news.vendor_press.v1","category":"news","decision_hint":"POSITIVE","envelope_target":"AX.OBS","fingerprint":"f855c341c19836cb8f64de5103e41c1af183dc65cd7879d22d937bb4fc123fe3","observed_at":"2026-07-16T04:44:04.234592Z","parent_run_hash":"392cd8ef881a5a54dbb7fbd0e0c490e4811d7ed32379244b3196bd5cb9c5d632","published":"Thu, 16 Jul 2026 00:00:00 -0400","runtime_version":"0.1.0","schema":"spider.news.vendor_press.v1","source_status":200,"source_url":"https://export.arxiv.org/rss/cs.AI","spider":"vendor_press","summary_excerpt":"arXiv:2607.13085v1 Announce Type: cross \nAbstract: Recent autonomous penetration testing papers report high benchmark scores while adding multi-component security harnesses around frontier LLMs. Because these systems often change both architecture and backbone model, it is difficult to tell how much performance comes from the harness rather than from the underlying model.\n  This paper presents a controlled study on the 104-task XBOW benchmark using default coding CLI agents as plain-agent baselines. We first run Codex, OpenCode, and Pi with the same GPT-5 model, budget, target interface, and scoring rule. This phase identifies the strongest same-model baseline and tests whether security-specific prompt variants improve its observed score. We then compare the default Codex scaffold with published MAPTA and PentestGPT V2 results under the closest available model matches. Finally, we repeat the plain-agent experiment with GPT-5.2 and GPT-5.5 to measure model scaling inside the same scaffo","title":"Baselines Before Architecture: Evaluating Coding Agents for Autonomous Penetration Testing","url":"https://arxiv.org/abs/2607.13085","vendor":"arxiv_cs_ai"},"summary":"arXiv:2607.13085v1 Announce Type: cross \nAbstract: Recent autonomous penetration testing papers report high benchmark scores while adding multi-component security harnesses around frontier LLMs. Because these systems often change both architecture and backbone model, it is difficult to tell how much performance comes from the harness rather than from the underlying model.\n  This paper presents a controlled study on the 104-task XBOW benchmark using default coding CLI agents as plain-agent baselines. We first run Codex, OpenCode, and Pi with the same GPT-5 model, budget, target interface, and scoring rule. This phase identifies the strongest same-model baseline and tests whether security-specific prompt variants improve its observed score. We then compare the default Codex scaffold with published MAPTA and PentestGPT V2 results under the closest available model matches. Finally, we repeat the plain-agent experiment with GPT-5.2 and GPT-5.5 to measure model scaling inside the same scaffo","title":"Baselines Before Architecture: Evaluating Coding Agents for Autonomous Penetration Testing","vendor":"arxiv_cs_ai"},"confidence":{"method":"deterministic"},"decision":"POSITIVE","issued_at":"2026-07-16T04:44:04Z","notes":"Spider vendor_press (news) news.vendor_press.v1","object":{"captured_by":"crovia.spider.vendor_press","primary_source_url":"https://arxiv.org/abs/2607.13085"},"predecessors":[],"schema":"crovia.axiom.v1","signature":"ed25519:15af28d67a5c9fc545a1b782aef2f3292fce5090a91391945e249957a81ab134e059882ae93f76a06c6201251bc24698622394f19b9b27be9337e8ccb4547c08","signer":"crovia.substrate","subject":{"observed_at":"2026-07-16T04:44:04Z","source_collector":"spider:vendor_press","target_id":"https://arxiv.org/abs/2607.13085"},"tsa":{"authority":"crovia.substrate.bootstrap","rfc3161_token":"{\"kind\":\"crovia.bootstrap.tsa\",\"source_jsonl\":\"/opt/crovia/spider/data/news/vendor_press_v1.jsonl\",\"source_seal_merkle_root\":\"spider_vendor_press_v1\",\"upgrade_path\":\"Sessione H \\u2014 OpenTimestamps weekly anchor\"}"},"zk_mode":"clear","zk_proof":null},"ledger":{"leaf_hash":"0a9affd2bf55f98fb0c9ef9037311f7b7149121f3309c006d3382100a33e5e08","leaf_index":319787,"ledger_path":"/opt/crovia/substrate/axiom_ledger.jsonl"},"merkle_proof":{"hash_alg":"sha256","leaf_prefix":"0x00","node_prefix":"0x01","odd_leaf_rule":"duplicate_last","path":[{"sibling":"43329ca20c29c949df60b1aefa6ec191e10278530e4793f40bc1bc11a95cbf93","side":"left"},{"sibling":"ebe8e799659b103c8acb4899197584270cdbbcce3e64ea33e20384c99e4d1faa","side":"left"},{"sibling":"23b6232421c3ed5cd12eaf05314920cf0506ed375d1340272aa6d5804e0fb049","side":"right"},{"sibling":"398edce0962344652b0e1315fa7b0dfe2ea8c174500e84e6e68c6595f42d6a88","side":"left"},{"sibling":"d330a95175604a11eded716068c20498eb0c898734e6af8f0a3b6f7fcd9ba4e7","side":"right"},{"sibling":"e8048dfcc4548d96d87cbfa04c4ae3f0cc2eeefaabc83c411e572e363fee19c6","side":"left"},{"sibling":"7afb932f161ff4724a1990887cc43d4adfc6ec58627f8a3dbdaf74b08b052856","side":"right"},{"sibling":"ec3fec9bb698cfe3c65d9f75111532c318eaa7e7c5b933ded046cea471e330ab","side":"right"},{"sibling":"929619d7bb5abd9d4c015f749565f8d43a371ed382bafe122457d67edb9b8323","side":"left"},{"sibling":"1290775fa2a1fe2079ed83a9c60b8cb479714b6312967daa62f6a91dbbe1cac9","side":"right"},{"sibling":"95977bf2fb44d423026e874e6c275f78b1cf48666d2c472c5e4603d16f4faf7f","side":"right"},{"sibling":"6b83879fdb76b5b7270071f1edfe4d1a059fa9b92653e70fc8c8893214b8f237","side":"right"},{"sibling":"ff49c1d8749b258f58cc33cfaf20d723098ed6860fb62a6779db960d6250915b","side":"right"},{"sibling":"34d85f6ad6cc7dfa79d90e2b9ff99a561bcdc75b0301bbbd3e83861f54535c1e","side":"left"},{"sibling":"f302542c38ba7c3aab7c9280dd60259ecec777dca6e6f71b6f0729b0b8791b72","side":"left"},{"sibling":"d8b9143917b539c543cf4448cec00131f8b807bd8004979c54ebe09798748c66","side":"left"},{"sibling":"3ee6ab8db1878db0b324dd807ca233edd472899b8e90d2c5e018848ea5d12d99","side":"right"},{"sibling":"73a8d1605c15a74de720f0c54b5b4567e3eb8b5999bd8812dc66eedc461540fa","side":"right"},{"sibling":"1cecb7f447febd025aac272837c80de218aecc6485d2395a509b2a1f1b9c746e","side":"left"}]},"schema":"crovia.axiom_proof.v1","seal":{"first_collector_run_id":"","first_receipt_hash":"","jsonl_path":"/opt/crovia/substrate/axiom_ledger.jsonl","key_id":"430895f101d38164","last_collector_run_id":"","last_receipt_hash":"","leaf_count":320080,"merkle_root":"1e159bceacfdb1f3c930dae410f8759ddc4c762abcfa4a257b150d6f44ab16e0","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","run_id":"hourly_json_retrofit_20260716T053701Z","schema":"crovia.seal.v1","seal_family_version":"crovia-seal-family/1","seal_kind":"substrate_batch","sealed_at":"2026-07-16T05:38:31Z","sig_algorithm":"ed25519","signature":"c1cd1fc5704d4fec4dee47b29a0e9877f8cfb41eb61dcfd783d82344a15f6e44d80d6cd5128849547b62fe9d9724fc71433319ab6030445b4ac1c9e6bf8a3709","signer_version":"1.1.0"},"trust_root":{"key_id":"430895f101d38164","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","signature_algorithm":"ed25519","url":"/registry/canon/TRUST_ROOT.md"},"verifier":{"spec":"/registry/canon/AXIOM_RECEIPT_v1.md","url":"/v/axm_401b722a34ea7fb9ec12a700831155b25a4da07e979c310a3bd0ceaa74b78e77"}}