{"_canonicalization":{"envelope_id":"axm_ + sha256(envelope minus {signature, axiom_id, anchors})","envelope_signature":"ed25519(envelope minus {signature, axiom_id})","json":"sort_keys=True, separators=(',',':'), ensure_ascii=False, allow_nan=False, utf-8","leaf_hash":"sha256(0x00 || canonical_json(envelope_full))","seal_signature":"ed25519(seal minus {signature, sig_algorithm})"},"axiom_id":"axm_974b1da0708424059f4ec60a324f77a8cfa4eb6d4b2ab2a490d247f6a2fc14d4","bitcoin_anchor":{"bitcoin_attestations":[],"calendar_attestations":[],"ots_url":"","stamped_at":"","status":"pending_next_stamp"},"envelope":{"anchors":[{"chain":"crovia.axiom_graph","height":0,"merkle_proof":"spider_vendor_press_v1","root_at_anchor":"spider_vendor_press_v1"}],"axiom_id":"axm_974b1da0708424059f4ec60a324f77a8cfa4eb6d4b2ab2a490d247f6a2fc14d4","axiom_type":"AX.OBS","body":{"axiom_subtype":"news.vendor_press.v1","category":"news","fingerprint":"ff9c68b5fe00920efe4c6b7d28aac87dff9e07614a5854767677464cc06f8b1d","published":"Mon, 01 Jun 2026 00:00:00 -0400","receipt_hash":"ff9c68b5fe00920efe4c6b7d28aac87dff9e07614a5854767677464cc06f8b1d","schema":"spider.news.vendor_press.v1","spider":"vendor_press","spider_record":{"axiom_subtype":"news.vendor_press.v1","category":"news","decision_hint":"POSITIVE","envelope_target":"AX.OBS","fingerprint":"ff9c68b5fe00920efe4c6b7d28aac87dff9e07614a5854767677464cc06f8b1d","observed_at":"2026-06-01T04:43:13.859018Z","parent_run_hash":"8993bbc535dae8c9669e099af3624cb39166b8d9bbfd66f26ae5c338cbb21be2","published":"Mon, 01 Jun 2026 00:00:00 -0400","runtime_version":"0.1.0","schema":"spider.news.vendor_press.v1","source_status":200,"source_url":"https://export.arxiv.org/rss/cs.AI","spider":"vendor_press","summary_excerpt":"arXiv:2605.30454v1 Announce Type: cross \nAbstract: Tool-augmented LLM agents are vulnerable to prompt injection: a third party who controls part of the agent's context can plant instructions that the agent then executes as if they came from the user. Current evaluations report a single attack success rate per model on one channel, the tool output and treat that number as the model's vulnerability. But tool descriptions, which the agent reads at every turn before any tool is called, are themselves an injection surface that the attacker can choose instead. We hold the injection payload byte-identical and deliver it through both surfaces across 13 LLMs from six families and four task suites. The same bytes invert in success rate across models: GPT-4.1 is 96 percent vulnerable on tool outputs but only 4 percent on tool descriptions, while GEMINI-3-FLASH shows the mirror pattern at 20 percent and 98 percent. A variance decomposition over 6,830 attempts attributes 0 percent of the variation ","title":"The Surface You Test Is Not the Surface That Breaks","url":"https://arxiv.org/abs/2605.30454","vendor":"arxiv_cs_ai"},"summary":"arXiv:2605.30454v1 Announce Type: cross \nAbstract: Tool-augmented LLM agents are vulnerable to prompt injection: a third party who controls part of the agent's context can plant instructions that the agent then executes as if they came from the user. Current evaluations report a single attack success rate per model on one channel, the tool output and treat that number as the model's vulnerability. But tool descriptions, which the agent reads at every turn before any tool is called, are themselves an injection surface that the attacker can choose instead. We hold the injection payload byte-identical and deliver it through both surfaces across 13 LLMs from six families and four task suites. The same bytes invert in success rate across models: GPT-4.1 is 96 percent vulnerable on tool outputs but only 4 percent on tool descriptions, while GEMINI-3-FLASH shows the mirror pattern at 20 percent and 98 percent. A variance decomposition over 6,830 attempts attributes 0 percent of the variation ","title":"The Surface You Test Is Not the Surface That Breaks","vendor":"arxiv_cs_ai"},"confidence":{"method":"deterministic"},"decision":"POSITIVE","issued_at":"2026-06-01T04:43:13Z","notes":"Spider vendor_press (news) news.vendor_press.v1","object":{"captured_by":"crovia.spider.vendor_press","primary_source_url":"https://arxiv.org/abs/2605.30454"},"predecessors":[],"schema":"crovia.axiom.v1","signature":"ed25519:1e0fc1cbc45db9a4a2717731c00091ba9a4dd8f281e32b403edb050483f62da39a2d6a1d99ad06823e5927ff350f8528bd7a15e24c4dc4745679a15ff2d2b60d","signer":"crovia.substrate","subject":{"observed_at":"2026-06-01T04:43:13Z","source_collector":"spider:vendor_press","target_id":"https://arxiv.org/abs/2605.30454"},"tsa":{"authority":"crovia.substrate.bootstrap","rfc3161_token":"{\"kind\":\"crovia.bootstrap.tsa\",\"source_jsonl\":\"/opt/crovia/spider/data/news/vendor_press_v1.jsonl\",\"source_seal_merkle_root\":\"spider_vendor_press_v1\",\"upgrade_path\":\"Sessione H \\u2014 OpenTimestamps weekly anchor\"}"},"zk_mode":"clear","zk_proof":null},"ledger":{"leaf_hash":"384f90279beeaca11af9b73dc633dea8f086ee4e5ad6fc8608799986581e7168","leaf_index":163827,"ledger_path":"/opt/crovia/substrate/axiom_ledger.jsonl"},"merkle_proof":{"hash_alg":"sha256","leaf_prefix":"0x00","node_prefix":"0x01","odd_leaf_rule":"duplicate_last","path":[{"sibling":"97b36165b06cc0e2aed0955763d64b986fb1411e21a49ea4b207f2d0d15cfcc9","side":"left"},{"sibling":"da21b9b527419a8871eb61dfeffe8ff75964bdb58de1334957da2d5df8992682","side":"left"},{"sibling":"9b0769e5db7bdbd9062cbc5ee35be999756fd9b7a0481581623e3b399950d03c","side":"right"},{"sibling":"7a0eda30b00ddf97226dce9638d78cdb727a9b7133f600bdbb8bec5397db425b","side":"right"},{"sibling":"4d05c1d10ce177e734550afbe0158142b54cf93075855777c739ec460dad2756","side":"left"},{"sibling":"a8f314233e57d9b2e1f73a238db7bf336c4b3b1673499ca02aeae9337c8cb49b","side":"left"},{"sibling":"6f506d4e4c7fb170ea5ab20efffbcbb69464bf6db4cde5e90925fede53e31584","side":"left"},{"sibling":"764e4312cdb701ef8613acdc2311e1724d6a379f21c70c30ed832e7ede3d2d33","side":"left"},{"sibling":"5a0517e6c348bc5a70f1aef04c1415d23980c712e375838fff54dfa281f98760","side":"left"},{"sibling":"d6986f4b6a5bd07cba1de43f660d527af780ad1465d0f4af5f137bd514e95f7e","side":"left"},{"sibling":"aff54f89d4445cf32bb05b2ece532d190200cb92524489ddfa648b5cc36e21a4","side":"left"},{"sibling":"f028fad1771bff7dceff3a83baf90249f4eb410ebedfe92dda1bb2b89d7093c8","side":"left"},{"sibling":"59c6490072e8a1d357ece10bb08d7f449a3acbae58e130e3e7469cbea0314c65","side":"left"},{"sibling":"66331bac84ca0f8983eb09fac7eaf95af234f1b82680b793eabff4ee25caac40","side":"left"},{"sibling":"35ca36cee447f0ef7064a25d55f59357c66901e31427729c4c1d8b14aa8adb6c","side":"left"},{"sibling":"c9ac00eed8c475f1e525869bb329af03d052181b19ff8234edefe12f6ecec154","side":"right"},{"sibling":"ce41d9b82f34b16efd653dfb3552acc4e2512939e47903e5fc979fbed00c5764","side":"right"},{"sibling":"d841ad93efda0869e5eb97678f348f03f5caab4353e05ff4bf18f47fb945b822","side":"left"}]},"schema":"crovia.axiom_proof.v1","seal":{"first_collector_run_id":"","first_receipt_hash":"","jsonl_path":"/opt/crovia/substrate/axiom_ledger.jsonl","key_id":"430895f101d38164","last_collector_run_id":"","last_receipt_hash":"","leaf_count":164217,"merkle_root":"a1098816aea1b60b8fe37b62410469bc5024a2c335bbec4f6ef2add7875dbdf2","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","run_id":"hourly_json_retrofit_20260601T053701Z","schema":"crovia.seal.v1","seal_family_version":"crovia-seal-family/1","seal_kind":"substrate_batch","sealed_at":"2026-06-01T05:37:41Z","sig_algorithm":"ed25519","signature":"d7f91db1d54b9495c499440c2828f4bd53360555391ce6e25adea5183bc1fa0f697d80708a099d0b0429e6f8cb6c71e7fccf82acb3c84481149974fb26074708","signer_version":"1.1.0"},"trust_root":{"key_id":"430895f101d38164","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","signature_algorithm":"ed25519","url":"/registry/canon/TRUST_ROOT.md"},"verifier":{"spec":"/registry/canon/AXIOM_RECEIPT_v1.md","url":"/v/axm_974b1da0708424059f4ec60a324f77a8cfa4eb6d4b2ab2a490d247f6a2fc14d4"}}