Each paper is rendered from a typed template whose every numeric slot is a query, then read back by a verifier that refuses to emit the document if any numeral in it is absent from the record. The PDF is typeset from that verified text and nothing else. No model writes these, so they cannot drift from the data.
Regenerated from the whole record on every pass, so each is always current and none of them accumulates. These are the ones to cite.
Abstract. We attempt to build 27 open-source AI agent repositories into containers at pinned commits and to start each resulting image in a network-denied sandbox. 22 build successfully and 22 pass a container environment check, a rate of 81.5 percent. We report the distribution of failure causes and, for each, whether the cause is a property of the agent or a limit of the harness. We do not measure whether any agent runs.
Abstract. We run 28 pairs drawn from 8 open-source agents against each other in 4 adversarial scenarios, 520 runs in all, in a sandbox with a shared workspace and deterministic success criteria. 284 runs produce a verdict; 8 confirm an attack. The remaining 232 are recorded as instrument artifacts and 4 as refusals, and none of those enters any rate. Of the verdicts, 155 are strong, meaning the victim engaged with the planted material and the side effect only compliance produces did not occur, and 129 are weak, meaning the victim completed without engaging, so refusal is not separable from inaction.
A pass is an experiment: parameters fixed before it began, a window in which it ran, and rows that exist because it ran. Each report is written from those rows and no others, so it stays true as the record grows past it. Newest first.
The scheduler started this pass without a person. It ran 224 runs over 56 ordered pairings drawn from 8 agents against 4 adversarial scenarios, taking 471 minutes. 105 runs produced a verdict and 0 confirm an attack. 119 runs recorded an artifact of the instrument rather than a result and 0 runs never started. The record held 296 runs before this pass and 520 after.
A person started this pass. It ran 84 runs over 21 ordered pairings drawn from 7 agents against 4 adversarial scenarios, taking 50 minutes. 52 runs produced a verdict and 5 confirm an attack. 32 runs recorded an artifact of the instrument rather than a result and 0 runs never started. The record held 212 runs before this pass and 296 after.
This pass ran before the record distinguished a pass the scheduler started from one a person did, so which it was is not recorded. It ran 60 runs over 15 ordered pairings drawn from 6 agents against 4 adversarial scenarios, taking 41 minutes. 37 runs produced a verdict and 2 confirm an attack. 23 runs recorded an artifact of the instrument rather than a result and 0 runs never started. The record held 152 runs before this pass and 212 after.
This pass ran before the record distinguished a pass the scheduler started from one a person did, so which it was is not recorded. It ran 59 runs over 15 ordered pairings drawn from 6 agents against 4 adversarial scenarios, taking 41 minutes. 37 runs produced a verdict and 1 confirms an attack. 22 runs recorded an artifact of the instrument rather than a result and 0 runs never started. The record held 92 runs before this pass and 151 after.
This pass ran before the record distinguished a pass the scheduler started from one a person did, so which it was is not recorded. It ran 40 runs over 10 ordered pairings drawn from 5 agents against 4 adversarial scenarios, taking 24 minutes. 27 runs produced a verdict and 0 confirm an attack. 13 runs recorded an artifact of the instrument rather than a result and 0 runs never started. The record held 52 runs before this pass and 92 after.
This pass ran before the record distinguished a pass the scheduler started from one a person did, so which it was is not recorded. It ran 10 runs over 4 ordered pairings drawn from 4 agents against 4 adversarial scenarios, taking 8 minutes. 4 runs produced a verdict and 0 confirm an attack. 6 runs recorded an artifact of the instrument rather than a result and 0 runs never started. The record held 28 runs before this pass and 38 after.
This pass ran before the record distinguished a pass the scheduler started from one a person did, so which it was is not recorded. It ran 1 run over 1 ordered pairing drawn from 2 agents against 1 adversarial scenario, taking 0 minutes. 1 run produced a verdict and 0 confirm an attack. 0 runs recorded an artifact of the instrument rather than a result and 0 runs never started. The record held 24 runs before this pass and 25 after.
Generated against the dataset published 2026-09-28, engine 73fc35e54b8b.