{"_canonicalization":{"envelope_id":"axm_ + sha256(envelope minus {signature, axiom_id, anchors})","envelope_signature":"ed25519(envelope minus {signature, axiom_id})","json":"sort_keys=True, separators=(',',':'), ensure_ascii=False, allow_nan=False, utf-8","leaf_hash":"sha256(0x00 || canonical_json(envelope_full))","seal_signature":"ed25519(seal minus {signature, sig_algorithm})"},"axiom_id":"axm_e6bf75d94ff4dcc0510c10f6cfb2662c538e717eeace020c9e748ec331763f31","bitcoin_anchor":{"bitcoin_attestations":[],"calendar_attestations":[],"ots_url":"","stamped_at":"","status":"pending_next_stamp"},"envelope":{"anchors":[{"chain":"crovia.axiom_graph","height":0,"merkle_proof":"spider_vendor_press_v1","root_at_anchor":"spider_vendor_press_v1"}],"axiom_id":"axm_e6bf75d94ff4dcc0510c10f6cfb2662c538e717eeace020c9e748ec331763f31","axiom_type":"AX.OBS","body":{"axiom_subtype":"news.vendor_press.v1","category":"news","fingerprint":"477c42f5b656166f1ba9389e330e7b9e29263003c5766bf96867d04a10dd5809","published":"Tue, 28 Jul 2026 00:00:00 -0400","receipt_hash":"477c42f5b656166f1ba9389e330e7b9e29263003c5766bf96867d04a10dd5809","schema":"spider.news.vendor_press.v1","spider":"vendor_press","spider_record":{"axiom_subtype":"news.vendor_press.v1","category":"news","decision_hint":"POSITIVE","envelope_target":"AX.OBS","fingerprint":"477c42f5b656166f1ba9389e330e7b9e29263003c5766bf96867d04a10dd5809","observed_at":"2026-07-28T04:43:08.282317Z","parent_run_hash":"23a1ef85134515049ced29518443d084afc46fd7c967741e6c6acdbdbbf29939","published":"Tue, 28 Jul 2026 00:00:00 -0400","runtime_version":"0.1.0","schema":"spider.news.vendor_press.v1","source_status":200,"source_url":"https://export.arxiv.org/rss/cs.AI","spider":"vendor_press","summary_excerpt":"arXiv:2607.24006v1 Announce Type: cross \nAbstract: Cloud telemetry arrives at a scale that, paradoxically, makes intrusion understanding harder rather than easier. Attackers operate through legitimate identity, federated session tokens, and cloud native APIs indistinguishable from routine administration, and analysts spend an incident reconstructing context the logs already contain. We present Cloud Decoy AI Agent, a framework pairing a high fidelity cloud decoy with an autonomous language model agent that compresses the path from suspicious activity to an analyst ready report. Connecting a decoy to an agent is not a wiring exercise. The unit of investigation is the session rather than the event, and the session key is obscured by the identity layering federated credentials introduce. The agent's evidence horizon must be bounded, since an agent free to query full control plane history inherits the cost and false positive profile deception was meant to remove. And cloud telemetry is par","title":"Agentic Cloud Decoys: A Deception-Driven Framework for Autonomous Intrusion Investigation","url":"https://arxiv.org/abs/2607.24006","vendor":"arxiv_cs_ai"},"summary":"arXiv:2607.24006v1 Announce Type: cross \nAbstract: Cloud telemetry arrives at a scale that, paradoxically, makes intrusion understanding harder rather than easier. Attackers operate through legitimate identity, federated session tokens, and cloud native APIs indistinguishable from routine administration, and analysts spend an incident reconstructing context the logs already contain. We present Cloud Decoy AI Agent, a framework pairing a high fidelity cloud decoy with an autonomous language model agent that compresses the path from suspicious activity to an analyst ready report. Connecting a decoy to an agent is not a wiring exercise. The unit of investigation is the session rather than the event, and the session key is obscured by the identity layering federated credentials introduce. The agent's evidence horizon must be bounded, since an agent free to query full control plane history inherits the cost and false positive profile deception was meant to remove. And cloud telemetry is par","title":"Agentic Cloud Decoys: A Deception-Driven Framework for Autonomous Intrusion Investigation","vendor":"arxiv_cs_ai"},"confidence":{"method":"deterministic"},"decision":"POSITIVE","issued_at":"2026-07-28T04:43:08Z","notes":"Spider vendor_press (news) news.vendor_press.v1","object":{"captured_by":"crovia.spider.vendor_press","primary_source_url":"https://arxiv.org/abs/2607.24006"},"predecessors":[],"schema":"crovia.axiom.v1","signature":"ed25519:65a46be823c0d4f439d16ef79ce85bb8405a0fac1475380aad0b01811cafbfed2baf36aa480b19345adfa4d15193b0fed2803c494acce2a2a98fad98fe16be07","signer":"crovia.substrate","subject":{"observed_at":"2026-07-28T04:43:08Z","source_collector":"spider:vendor_press","target_id":"https://arxiv.org/abs/2607.24006"},"tsa":{"authority":"crovia.substrate.bootstrap","rfc3161_token":"{\"kind\":\"crovia.bootstrap.tsa\",\"source_jsonl\":\"/opt/crovia/spider/data/news/vendor_press_v1.jsonl\",\"source_seal_merkle_root\":\"spider_vendor_press_v1\",\"upgrade_path\":\"Sessione H \\u2014 OpenTimestamps weekly anchor\"}"},"zk_mode":"clear","zk_proof":null},"ledger":{"leaf_hash":"8dd3f062912cefbe75bd644a0e9c3da2618279a5abb58a4eb79a41b07f7da827","leaf_index":360659,"ledger_path":"/opt/crovia/substrate/axiom_ledger.jsonl"},"merkle_proof":{"hash_alg":"sha256","leaf_prefix":"0x00","node_prefix":"0x01","odd_leaf_rule":"duplicate_last","path":[{"sibling":"629a69820225ca9bbe5ea80acceae206b1c097eb48a6a90b304b925c517de41d","side":"left"},{"sibling":"bf8c7f636f1d9f91175689c76f838af51dd6115aad2548f9b4743861067144a3","side":"left"},{"sibling":"f5e0febc17500b2e5fb6b2925c61e156fa5135ec18c5636dfac99a67edcdfb52","side":"right"},{"sibling":"a44ca1ea99a5c9639b9cde4c0b493c939f9cc203e973340f986a3225d05839ba","side":"right"},{"sibling":"74dcd9b2469afbc7fbaaf1a05925942f1ceb9c4e85e1dc04c10940d857eee8c8","side":"left"},{"sibling":"71e3d037154b4e61e222fdc5022cb475ded43844c68e54a0f8ad776d5fefdcec","side":"right"},{"sibling":"9f375fc8a084716711a7be00248cf68ffa1f4a9755be4f482aa761dcf36b15f9","side":"left"},{"sibling":"43776f432cc587f28ede8eaf5e1d4a4c47951623abe35c898f8f1127bf5ff870","side":"left"},{"sibling":"eb79f1d599c07786d2268140481af8b617999ecc5688c6283fe58e5e6f3a2640","side":"right"},{"sibling":"fe03c6d0b083c4097049d7fc6d7d08dfdb05d9c198b2786336689712d66eabf0","side":"right"},{"sibling":"590ea76fdfc1b9e8072055c378be3182f916709e8d06bd955232e650a7188b86","side":"right"},{"sibling":"d92781c59301ffd5bfb0bad75d9fdf6d73879f715518149d383f7362213e0daf","side":"right"},{"sibling":"f315303d4402b57497416d48eb4c4bb50405b40862d41c7caf318cb3d29c5237","side":"right"},{"sibling":"36973eb5f586cd67e0c0dc055dd87e734aa544c35d4400d2c9f932f8ef8fb27f","side":"right"},{"sibling":"e39f7900355489c4718b21cc2d3d06382e1d2f22b864d10be9ebc9d498b279a1","side":"right"},{"sibling":"1f9a970b25dd938c98cabc9e0a55c5a6f46292b9fa37cc89d90ef0cbb1e05a8c","side":"left"},{"sibling":"77025bcb374a7ad74f520643e20a8ae1205a7ee78507b0beb93117760f1c29d3","side":"left"},{"sibling":"3b50864499c874394ea0928567747666eaf59b01380e46cd52164ec5acec0f71","side":"right"},{"sibling":"1cecb7f447febd025aac272837c80de218aecc6485d2395a509b2a1f1b9c746e","side":"left"}]},"schema":"crovia.axiom_proof.v1","seal":{"first_collector_run_id":"","first_receipt_hash":"","jsonl_path":"/opt/crovia/substrate/axiom_ledger.jsonl","key_id":"430895f101d38164","last_collector_run_id":"","last_receipt_hash":"","leaf_count":361008,"merkle_root":"3065e8369ea437c06beba806dc4e4bb159979adeb21fe632242c1906a7204647","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","run_id":"hourly_json_retrofit_20260728T053701Z","schema":"crovia.seal.v1","seal_family_version":"crovia-seal-family/1","seal_kind":"substrate_batch","sealed_at":"2026-07-28T05:38:48Z","sig_algorithm":"ed25519","signature":"9141644407577a82611c1579110f667de2d46dc6b93c6322edf26f4c3056ea99f0e56502853908e30d87c38bcf95eb6e0ab5130525aa51505bd6f61938120609","signer_version":"1.1.0"},"trust_root":{"key_id":"430895f101d38164","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","signature_algorithm":"ed25519","url":"/registry/canon/TRUST_ROOT.md"},"verifier":{"spec":"/registry/canon/AXIOM_RECEIPT_v1.md","url":"/v/axm_e6bf75d94ff4dcc0510c10f6cfb2662c538e717eeace020c9e748ec331763f31"}}