{"_canonicalization":{"envelope_id":"axm_ + sha256(envelope minus {signature, axiom_id, anchors})","envelope_signature":"ed25519(envelope minus {signature, axiom_id})","json":"sort_keys=True, separators=(',',':'), ensure_ascii=False, allow_nan=False, utf-8","leaf_hash":"sha256(0x00 || canonical_json(envelope_full))","seal_signature":"ed25519(seal minus {signature, sig_algorithm})"},"axiom_id":"axm_9841361a01574d2529be1f6bfb1c01ddeab4ae1cb7a5ff54ccf5c296a308be63","bitcoin_anchor":{"bitcoin_attestations":["bitcoin_block_949451"],"calendar_attestations":["https://finney.calendar.eternitywall.com","https://btc.calendar.catallaxy.com","https://alice.btc.calendar.opentimestamps.org","https://bob.btc.calendar.opentimestamps.org"],"ots_url":"/registry/data/substrate/anchors/77fc9c28fae777b81da5b495b3115474df6592dfac590333213d3bdf8b94a9b3.ots","stamped_at":"2026-05-15T03:00:03Z","status":"bitcoin"},"envelope":{"anchors":[{"chain":"crovia.axiom_graph","height":0,"merkle_proof":"spider_vendor_press_v1","root_at_anchor":"spider_vendor_press_v1"}],"axiom_id":"axm_9841361a01574d2529be1f6bfb1c01ddeab4ae1cb7a5ff54ccf5c296a308be63","axiom_type":"AX.OBS","body":{"axiom_subtype":"news.vendor_press.v1","category":"news","fingerprint":"782ef84a16fbe2b1e91d330cc77ea9e9201458936264cc80cb5bced154f21a90","published":"Tue, 12 May 2026 00:00:00 -0400","receipt_hash":"782ef84a16fbe2b1e91d330cc77ea9e9201458936264cc80cb5bced154f21a90","schema":"spider.news.vendor_press.v1","spider":"vendor_press","spider_record":{"axiom_subtype":"news.vendor_press.v1","category":"news","decision_hint":"POSITIVE","envelope_target":"AX.OBS","fingerprint":"782ef84a16fbe2b1e91d330cc77ea9e9201458936264cc80cb5bced154f21a90","observed_at":"2026-05-12T04:43:42.564879Z","parent_run_hash":"4cc5aca0c1b8116c9ab92405e0260204f01cf7ce2e49dea9d7e123236f5dc13b","published":"Tue, 12 May 2026 00:00:00 -0400","runtime_version":"0.1.0","schema":"spider.news.vendor_press.v1","source_status":200,"source_url":"https://export.arxiv.org/rss/cs.AI","spider":"vendor_press","summary_excerpt":"arXiv:2605.10834v1 Announce Type: new \nAbstract: AI pentesting agents are increasingly credible as offensive security systems, but current benchmarks still provide limited guidance on which will perform best in real-world targets. Existing evaluation protocols assess and optimize for predefined goals such as capture-the-flag, remote code execution, exploit reproduction, or trajectory similarity, in simplified or narrow settings. These tools are valuable for measuring bounded capabilities, yet they do not adequately capture the complexity, open-ended exploration, and strategic decision-making required in realistic pentesting. In this paper, we present a practical evaluation protocol that shifts assessment from task completion to validated vulnerability discovery, allowing evaluation in sufficiently complex targets spanning multiple attack surfaces and vulnerability classes. The protocol combines structured ground-truth with LLM-based semantic matching to identify vulnerabilities, bipart","title":"From Controlled to the Wild: Evaluation of Pentesting Agents for the Real-World","url":"https://arxiv.org/abs/2605.10834","vendor":"arxiv_cs_ai"},"summary":"arXiv:2605.10834v1 Announce Type: new \nAbstract: AI pentesting agents are increasingly credible as offensive security systems, but current benchmarks still provide limited guidance on which will perform best in real-world targets. Existing evaluation protocols assess and optimize for predefined goals such as capture-the-flag, remote code execution, exploit reproduction, or trajectory similarity, in simplified or narrow settings. These tools are valuable for measuring bounded capabilities, yet they do not adequately capture the complexity, open-ended exploration, and strategic decision-making required in realistic pentesting. In this paper, we present a practical evaluation protocol that shifts assessment from task completion to validated vulnerability discovery, allowing evaluation in sufficiently complex targets spanning multiple attack surfaces and vulnerability classes. The protocol combines structured ground-truth with LLM-based semantic matching to identify vulnerabilities, bipart","title":"From Controlled to the Wild: Evaluation of Pentesting Agents for the Real-World","vendor":"arxiv_cs_ai"},"confidence":{"method":"deterministic"},"decision":"POSITIVE","issued_at":"2026-05-12T04:43:42Z","notes":"Spider vendor_press (news) news.vendor_press.v1","object":{"captured_by":"crovia.spider.vendor_press","primary_source_url":"https://arxiv.org/abs/2605.10834"},"predecessors":[],"schema":"crovia.axiom.v1","signature":"ed25519:d74bc66b3aa2c849a971f6f3384802ea42c9690f86a21b399e0a732d1b0cdea17073d2b1141b3149e4434cff8874fb3abcf9f8ed59e52bb6e65e6e68cd8f3502","signer":"crovia.substrate","subject":{"observed_at":"2026-05-12T04:43:42Z","source_collector":"spider:vendor_press","target_id":"https://arxiv.org/abs/2605.10834"},"tsa":{"authority":"crovia.substrate.bootstrap","rfc3161_token":"{\"kind\":\"crovia.bootstrap.tsa\",\"source_jsonl\":\"/opt/crovia/spider/data/news/vendor_press_v1.jsonl\",\"source_seal_merkle_root\":\"spider_vendor_press_v1\",\"upgrade_path\":\"Sessione H \\u2014 OpenTimestamps weekly anchor\"}"},"zk_mode":"clear","zk_proof":null},"ledger":{"leaf_hash":"5f244a7192faa352f1fe86dc7cb56307540e59a270c8c9e47aca56449154702b","leaf_index":128444,"ledger_path":"/opt/crovia/substrate/axiom_ledger.jsonl"},"merkle_proof":{"hash_alg":"sha256","leaf_prefix":"0x00","node_prefix":"0x01","odd_leaf_rule":"duplicate_last","path":[{"sibling":"49fd7e5cbcdd8b87e56e623d376cb9390bff684551e7a78066ed8c0ce55cc4b8","side":"right"},{"sibling":"979d750a612a3be74c7a359e817af47229bb2beb984e2c106d027f7e263d7791","side":"right"},{"sibling":"21057608d5cb61f50d9e59f7d7c5ea34880555f39ea391b5fd31f238f9496885","side":"left"},{"sibling":"f696c7cf50a327abc17c1c1f5c515982e9defe093eb273c8274ddc4dd5f76b9c","side":"left"},{"sibling":"842cfd1258a79f2ee8ad1bbd77e2465f17efc51f735862b4401cd7d57f834ec0","side":"left"},{"sibling":"230c3d016948314348a06d94b173b8030fd4afbcce902ed89997b56727fc1a2b","side":"left"},{"sibling":"0d2e2a03cbbaaaf9b359ac04d26d1134ca661c8a9f351c4874b0b3550f597903","side":"right"},{"sibling":"0fac4565968e7e49cfc1d10e28cfc4966c72b4dd0deb14bce20d28acb7a0d65a","side":"left"},{"sibling":"aa3ddc60ad25fcdd4bf93520d8baeca26d807789d80fb0deffbb19c4f8882286","side":"left"},{"sibling":"077005bbaed7b42537914de0b512ed52d33243215eab288181aba807d37bf04e","side":"right"},{"sibling":"c6eaf7a4fcab2db96e9e9423acb6922c80f64882d0f3f50d09e53a4807d23084","side":"left"},{"sibling":"df12eaabc0a370aff5d0488478f48d2b3f90d025c903643f98ea804b017688ec","side":"right"},{"sibling":"ffc4d51379293bc3e1910c7d612f409dc610fd9acf8241793fb89f82e1bad4ef","side":"left"},{"sibling":"62ac6554017807bd83187f5a3e5f4f72d6c482616429c2780e9fff1f4845fa04","side":"left"},{"sibling":"3a5e69cf0803f4c91f3895ed7c9a95748fef240bec4422e167c05300f79f06c0","side":"left"},{"sibling":"f2817ab288b5324fe49770372c7a10f33f7cd11005f8d4c0a730316f5229dc98","side":"left"},{"sibling":"725fac972e772ca0dc598810ea1abc70df472f72d2d6ab8a0baee2b80e5d2f4c","side":"left"},{"sibling":"98fc57dfef8873b512edc8340f7181df57302bb96777625e072235c62d7c5895","side":"right"}]},"schema":"crovia.axiom_proof.v1","seal":{"first_collector_run_id":"","first_receipt_hash":"","jsonl_path":"/opt/crovia/substrate/axiom_ledger.jsonl","key_id":"430895f101d38164","last_collector_run_id":"","last_receipt_hash":"","leaf_count":134292,"merkle_root":"77fc9c28fae777b81da5b495b3115474df6592dfac590333213d3bdf8b94a9b3","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","run_id":"hourly_json_retrofit_20260515T023701Z","schema":"crovia.seal.v1","seal_family_version":"crovia-seal-family/1","seal_kind":"substrate_batch","sealed_at":"2026-05-15T02:37:25Z","sig_algorithm":"ed25519","signature":"68107a834b00b24f5d4501e5ec727445311f132a486567ecc4c72a4e6dff24c8c21f2de3105293353ba5fdbe370d032819af6aa70f694e2e39b6af6737507009","signer_version":"1.1.0"},"trust_root":{"key_id":"430895f101d38164","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","signature_algorithm":"ed25519","url":"/registry/canon/TRUST_ROOT.md"},"verifier":{"spec":"/registry/canon/AXIOM_RECEIPT_v1.md","url":"/v/axm_9841361a01574d2529be1f6bfb1c01ddeab4ae1cb7a5ff54ccf5c296a308be63"}}