{"_canonicalization":{"envelope_id":"axm_ + sha256(envelope minus {signature, axiom_id, anchors})","envelope_signature":"ed25519(envelope minus {signature, axiom_id})","json":"sort_keys=True, separators=(',',':'), ensure_ascii=False, allow_nan=False, utf-8","leaf_hash":"sha256(0x00 || canonical_json(envelope_full))","seal_signature":"ed25519(seal minus {signature, sig_algorithm})"},"axiom_id":"axm_64cccd012138aec2915913d9f8ce2366dde7ceac7b98da97727079c97cb85809","bitcoin_anchor":{"bitcoin_attestations":[],"calendar_attestations":[],"ots_url":"","stamped_at":"","status":"pending_next_stamp"},"envelope":{"anchors":[{"chain":"crovia.axiom_graph","height":0,"merkle_proof":"spider_vendor_press_v1","root_at_anchor":"spider_vendor_press_v1"}],"axiom_id":"axm_64cccd012138aec2915913d9f8ce2366dde7ceac7b98da97727079c97cb85809","axiom_type":"AX.OBS","body":{"axiom_subtype":"news.vendor_press.v1","category":"news","fingerprint":"4e1d4f0227c2bc6f44f5e4a5b5d4a8e3c3fe296687bde734c70f5297da7f8f3a","published":"Tue, 28 Jul 2026 00:00:00 -0400","receipt_hash":"4e1d4f0227c2bc6f44f5e4a5b5d4a8e3c3fe296687bde734c70f5297da7f8f3a","schema":"spider.news.vendor_press.v1","spider":"vendor_press","spider_record":{"axiom_subtype":"news.vendor_press.v1","category":"news","decision_hint":"POSITIVE","envelope_target":"AX.OBS","fingerprint":"4e1d4f0227c2bc6f44f5e4a5b5d4a8e3c3fe296687bde734c70f5297da7f8f3a","observed_at":"2026-07-28T04:43:08.282317Z","parent_run_hash":"23a1ef85134515049ced29518443d084afc46fd7c967741e6c6acdbdbbf29939","published":"Tue, 28 Jul 2026 00:00:00 -0400","runtime_version":"0.1.0","schema":"spider.news.vendor_press.v1","source_status":200,"source_url":"https://export.arxiv.org/rss/cs.AI","spider":"vendor_press","summary_excerpt":"arXiv:2607.22569v1 Announce Type: new \nAbstract: Coding agents are increasingly integrated into system operations, where their tool use can directly modify project artifacts, execution environments, and the underlying system. For example, if a coding agent inserts a hook into a system startup or configuration script, that change can persist after the interaction, be triggered later, and abuse delegated user or system privileges to modify the system. This makes security testing a system problem: the key question is not only what the agent says, but what it actually does to the surrounding environment. We present an execution-grounded red-team testing framework for probing this execution-layer security boundary using observable sandbox evidence, including tool invocations, runtime traces, and file-system diffs. Our framework embeds target unsafe operations into routine software engineering workloads, including unit testing, regression testing, crash reproduction, and validation, and uses","title":"Execution-Grounded Security Testing for Coding Agents in Software Engineering Pipelines","url":"https://arxiv.org/abs/2607.22569","vendor":"arxiv_cs_ai"},"summary":"arXiv:2607.22569v1 Announce Type: new \nAbstract: Coding agents are increasingly integrated into system operations, where their tool use can directly modify project artifacts, execution environments, and the underlying system. For example, if a coding agent inserts a hook into a system startup or configuration script, that change can persist after the interaction, be triggered later, and abuse delegated user or system privileges to modify the system. This makes security testing a system problem: the key question is not only what the agent says, but what it actually does to the surrounding environment. We present an execution-grounded red-team testing framework for probing this execution-layer security boundary using observable sandbox evidence, including tool invocations, runtime traces, and file-system diffs. Our framework embeds target unsafe operations into routine software engineering workloads, including unit testing, regression testing, crash reproduction, and validation, and uses","title":"Execution-Grounded Security Testing for Coding Agents in Software Engineering Pipelines","vendor":"arxiv_cs_ai"},"confidence":{"method":"deterministic"},"decision":"POSITIVE","issued_at":"2026-07-28T04:43:08Z","notes":"Spider vendor_press (news) news.vendor_press.v1","object":{"captured_by":"crovia.spider.vendor_press","primary_source_url":"https://arxiv.org/abs/2607.22569"},"predecessors":[],"schema":"crovia.axiom.v1","signature":"ed25519:0eae608b0bc132304ffe02fc7b63e4ed74a133935545a4323e042647d84a475031afb99623b02f09aca5a6b5e60deba645bb06fbf250ebc245db451ab9e75b03","signer":"crovia.substrate","subject":{"observed_at":"2026-07-28T04:43:08Z","source_collector":"spider:vendor_press","target_id":"https://arxiv.org/abs/2607.22569"},"tsa":{"authority":"crovia.substrate.bootstrap","rfc3161_token":"{\"kind\":\"crovia.bootstrap.tsa\",\"source_jsonl\":\"/opt/crovia/spider/data/news/vendor_press_v1.jsonl\",\"source_seal_merkle_root\":\"spider_vendor_press_v1\",\"upgrade_path\":\"Sessione H \\u2014 OpenTimestamps weekly anchor\"}"},"zk_mode":"clear","zk_proof":null},"ledger":{"leaf_hash":"60bb0041e8c68d9722631747b718788d3e24a9f047d8628488ef5c816c1d0331","leaf_index":360320,"ledger_path":"/opt/crovia/substrate/axiom_ledger.jsonl"},"merkle_proof":{"hash_alg":"sha256","leaf_prefix":"0x00","node_prefix":"0x01","odd_leaf_rule":"duplicate_last","path":[{"sibling":"dd7ccffb9dc40aaeddc2740bf57b7d4ababedb45e1a25d0707d9f8779185e626","side":"right"},{"sibling":"e5c5d3e38fc68c631d8d86fb5021afa690734ec792eb68b70f356b982ee37c5f","side":"right"},{"sibling":"e903712f1f044a28c9debee3cea739e5067e2007efa381dd7fb61de5aec97baf","side":"right"},{"sibling":"32cf6e019ab66e3fae4ecb0e54f562755e8b80f0d115d56d99a25001dde33ba1","side":"right"},{"sibling":"abad7bb98b8ed03c8ac90e1cb738b6cea860e4eb9925715cb54360f99561ce70","side":"right"},{"sibling":"d37ffa11305d6d9fceec26104df82aea607e4a2930cc769267c77453f7e47b9e","side":"right"},{"sibling":"48dace931609a55569e4aa242be3eefac99c722b35aa9345c111116089b4e976","side":"right"},{"sibling":"ce393210d8cb9e0705a24ff80bd76d7becf22bfce1258f4a57fd2dbdca17218b","side":"left"},{"sibling":"8fe957ea378915d410087f8b2c41171bdfdac25ba34c42d93c5aaa835f32246c","side":"left"},{"sibling":"f57ebea8749a327b4323e9ad9c906a9400f5a5d8c83084dfc7d80be83bd44007","side":"left"},{"sibling":"4424ff61f20c9cef2251672611ec86369d87b1608ab089738930fd3d52e0dd54","side":"left"},{"sibling":"8db22b6d8b4004df8ccd40f648d9fd8a62f564821c80fbfd9c743849f4102e1b","side":"left"},{"sibling":"cff500acb83b14a8a7195a72d90dd4b7a6b8a28fc1069f8300b1191728718f90","side":"left"},{"sibling":"51ee2566d84aba54b9d07233fb460f9fab044b4edfa3fbe376fa1df0727acfa5","side":"left"},{"sibling":"f3e45bceed774d2402fa45d41ff5190f295823bd2f216eb90157884150034693","side":"left"},{"sibling":"2096cd69b54e283ddc45b26b63564a5e4c02f303ffd855b3b3533bcf26bc284d","side":"right"},{"sibling":"77025bcb374a7ad74f520643e20a8ae1205a7ee78507b0beb93117760f1c29d3","side":"left"},{"sibling":"3b50864499c874394ea0928567747666eaf59b01380e46cd52164ec5acec0f71","side":"right"},{"sibling":"1cecb7f447febd025aac272837c80de218aecc6485d2395a509b2a1f1b9c746e","side":"left"}]},"schema":"crovia.axiom_proof.v1","seal":{"first_collector_run_id":"","first_receipt_hash":"","jsonl_path":"/opt/crovia/substrate/axiom_ledger.jsonl","key_id":"430895f101d38164","last_collector_run_id":"","last_receipt_hash":"","leaf_count":361008,"merkle_root":"3065e8369ea437c06beba806dc4e4bb159979adeb21fe632242c1906a7204647","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","run_id":"hourly_json_retrofit_20260728T053701Z","schema":"crovia.seal.v1","seal_family_version":"crovia-seal-family/1","seal_kind":"substrate_batch","sealed_at":"2026-07-28T05:38:48Z","sig_algorithm":"ed25519","signature":"9141644407577a82611c1579110f667de2d46dc6b93c6322edf26f4c3056ea99f0e56502853908e30d87c38bcf95eb6e0ab5130525aa51505bd6f61938120609","signer_version":"1.1.0"},"trust_root":{"key_id":"430895f101d38164","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","signature_algorithm":"ed25519","url":"/registry/canon/TRUST_ROOT.md"},"verifier":{"spec":"/registry/canon/AXIOM_RECEIPT_v1.md","url":"/v/axm_64cccd012138aec2915913d9f8ce2366dde7ceac7b98da97727079c97cb85809"}}