{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:57FCLJVJ2ZQWW7M6SIAJIVBF4V","short_pith_number":"pith:57FCLJVJ","canonical_record":{"source":{"id":"2607.02873","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.SE","submitted_at":"2026-07-03T02:20:04Z","cross_cats_sorted":["cs.AI","cs.CR"],"title_canon_sha256":"5094187745637258a2bc41ad26e58b1114ebeb6fa004d18c7fbc505b31fe74f0","abstract_canon_sha256":"11401872b8f84226c5b8c2bbda99a802e347c82cefb2e558d52160dda47acfeb"},"schema_version":"1.0"},"canonical_sha256":"efca25a6a9d6616b7d9e9200945425e5465152aa45286af9339495956d2b8a0e","source":{"kind":"arxiv","id":"2607.02873","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2607.02873","created_at":"2026-07-07T01:16:35Z"},{"alias_kind":"arxiv_version","alias_value":"2607.02873v1","created_at":"2026-07-07T01:16:35Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.02873","created_at":"2026-07-07T01:16:35Z"},{"alias_kind":"pith_short_12","alias_value":"57FCLJVJ2ZQW","created_at":"2026-07-07T01:16:35Z"},{"alias_kind":"pith_short_16","alias_value":"57FCLJVJ2ZQWW7M6","created_at":"2026-07-07T01:16:35Z"},{"alias_kind":"pith_short_8","alias_value":"57FCLJVJ","created_at":"2026-07-07T01:16:35Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:57FCLJVJ2ZQWW7M6SIAJIVBF4V","target":"record","payload":{"canonical_record":{"source":{"id":"2607.02873","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.SE","submitted_at":"2026-07-03T02:20:04Z","cross_cats_sorted":["cs.AI","cs.CR"],"title_canon_sha256":"5094187745637258a2bc41ad26e58b1114ebeb6fa004d18c7fbc505b31fe74f0","abstract_canon_sha256":"11401872b8f84226c5b8c2bbda99a802e347c82cefb2e558d52160dda47acfeb"},"schema_version":"1.0"},"canonical_sha256":"efca25a6a9d6616b7d9e9200945425e5465152aa45286af9339495956d2b8a0e","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-07T01:16:35.019025Z","signature_b64":"zNiNM9EIW7ge5l1kS4UM2gZy218mxx8Mob6DYyK3K3VvL2GsA+xuB1jWdt2L/CYOLknVgaSU5xu8pXKUftHhAg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"efca25a6a9d6616b7d9e9200945425e5465152aa45286af9339495956d2b8a0e","last_reissued_at":"2026-07-07T01:16:35.018505Z","signature_status":"signed_v1","first_computed_at":"2026-07-07T01:16:35.018505Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2607.02873","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-07T01:16:35Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"AGgtT8WOFGRH4XA/JV0kgBeiaCPp1cgmJ7A08s2Qb0sn8bq/snyXwkdNJGMNiexUQ51Llqgyj+jOCxds5JEPAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-01T17:53:18.216206Z"},"content_sha256":"7db8194b2342e2861db5f9f1a67ba028c22d3c956ff0f3757826482f6a680209","schema_version":"1.0","event_id":"sha256:7db8194b2342e2861db5f9f1a67ba028c22d3c956ff0f3757826482f6a680209"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:57FCLJVJ2ZQWW7M6SIAJIVBF4V","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Determinants and Limits of LLM Security-Tool Orchestration: A Study with HexStrike-AI","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","headline":"","cross_cats":["cs.AI","cs.CR"],"primary_cat":"cs.SE","authors_text":"Assmaa Zeghaider, Romain Gerard, Yan Guo","submitted_at":"2026-07-03T02:20:04Z","abstract_excerpt":"Large language model agents driving security tool suites over the Model Context Protocol are increasingly common. Yet the factors that bound their capability remain poorly characterized: how much depends on the model versus the client that drives it, whether constraining the agent to the orchestrator's own tools helps, and where capability is limited by reasoning rather than by missing tools. Using HexStrikeAI, an open-source orchestrator that exposes 150+ tools, as a testbed, we follow a methodology that evaluates the system, diagnoses its failures, and applies targeted improvements. We run 8"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.02873","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2607.02873/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-07T01:16:35Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"hXCxykKBg2ZntFiE4Cc35ZbC2JiUShlOnEjaHWNAAxdhzXwvkaQYKB9FwesdvnzrP7AJbqNGYcDMnjxgZfCeCQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-01T17:53:18.216514Z"},"content_sha256":"b50696893bdd807c5caabf20fbc66c541f7334ab8498ab2c36c7778d77c79754","schema_version":"1.0","event_id":"sha256:b50696893bdd807c5caabf20fbc66c541f7334ab8498ab2c36c7778d77c79754"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/57FCLJVJ2ZQWW7M6SIAJIVBF4V/bundle.json","state_url":"https://pith.science/pith/57FCLJVJ2ZQWW7M6SIAJIVBF4V/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/57FCLJVJ2ZQWW7M6SIAJIVBF4V/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-01T17:53:18Z","links":{"resolver":"https://pith.science/pith/57FCLJVJ2ZQWW7M6SIAJIVBF4V","bundle":"https://pith.science/pith/57FCLJVJ2ZQWW7M6SIAJIVBF4V/bundle.json","state":"https://pith.science/pith/57FCLJVJ2ZQWW7M6SIAJIVBF4V/state.json","well_known_bundle":"https://pith.science/.well-known/pith/57FCLJVJ2ZQWW7M6SIAJIVBF4V/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:57FCLJVJ2ZQWW7M6SIAJIVBF4V","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"11401872b8f84226c5b8c2bbda99a802e347c82cefb2e558d52160dda47acfeb","cross_cats_sorted":["cs.AI","cs.CR"],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.SE","submitted_at":"2026-07-03T02:20:04Z","title_canon_sha256":"5094187745637258a2bc41ad26e58b1114ebeb6fa004d18c7fbc505b31fe74f0"},"schema_version":"1.0","source":{"id":"2607.02873","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2607.02873","created_at":"2026-07-07T01:16:35Z"},{"alias_kind":"arxiv_version","alias_value":"2607.02873v1","created_at":"2026-07-07T01:16:35Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.02873","created_at":"2026-07-07T01:16:35Z"},{"alias_kind":"pith_short_12","alias_value":"57FCLJVJ2ZQW","created_at":"2026-07-07T01:16:35Z"},{"alias_kind":"pith_short_16","alias_value":"57FCLJVJ2ZQWW7M6","created_at":"2026-07-07T01:16:35Z"},{"alias_kind":"pith_short_8","alias_value":"57FCLJVJ","created_at":"2026-07-07T01:16:35Z"}],"graph_snapshots":[{"event_id":"sha256:b50696893bdd807c5caabf20fbc66c541f7334ab8498ab2c36c7778d77c79754","target":"graph","created_at":"2026-07-07T01:16:35Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2607.02873/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Large language model agents driving security tool suites over the Model Context Protocol are increasingly common. Yet the factors that bound their capability remain poorly characterized: how much depends on the model versus the client that drives it, whether constraining the agent to the orchestrator's own tools helps, and where capability is limited by reasoning rather than by missing tools. Using HexStrikeAI, an open-source orchestrator that exposes 150+ tools, as a testbed, we follow a methodology that evaluates the system, diagnoses its failures, and applies targeted improvements. We run 8","authors_text":"Assmaa Zeghaider, Romain Gerard, Yan Guo","cross_cats":["cs.AI","cs.CR"],"headline":"","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.SE","submitted_at":"2026-07-03T02:20:04Z","title":"Determinants and Limits of LLM Security-Tool Orchestration: A Study with HexStrike-AI"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.02873","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:7db8194b2342e2861db5f9f1a67ba028c22d3c956ff0f3757826482f6a680209","target":"record","created_at":"2026-07-07T01:16:35Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"11401872b8f84226c5b8c2bbda99a802e347c82cefb2e558d52160dda47acfeb","cross_cats_sorted":["cs.AI","cs.CR"],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.SE","submitted_at":"2026-07-03T02:20:04Z","title_canon_sha256":"5094187745637258a2bc41ad26e58b1114ebeb6fa004d18c7fbc505b31fe74f0"},"schema_version":"1.0","source":{"id":"2607.02873","kind":"arxiv","version":1}},"canonical_sha256":"efca25a6a9d6616b7d9e9200945425e5465152aa45286af9339495956d2b8a0e","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"efca25a6a9d6616b7d9e9200945425e5465152aa45286af9339495956d2b8a0e","first_computed_at":"2026-07-07T01:16:35.018505Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-07T01:16:35.018505Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"zNiNM9EIW7ge5l1kS4UM2gZy218mxx8Mob6DYyK3K3VvL2GsA+xuB1jWdt2L/CYOLknVgaSU5xu8pXKUftHhAg==","signature_status":"signed_v1","signed_at":"2026-07-07T01:16:35.019025Z","signed_message":"canonical_sha256_bytes"},"source_id":"2607.02873","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:7db8194b2342e2861db5f9f1a67ba028c22d3c956ff0f3757826482f6a680209","sha256:b50696893bdd807c5caabf20fbc66c541f7334ab8498ab2c36c7778d77c79754"],"state_sha256":"ae339b8d6287ea1f06957815ad3197f3d2dd2c9c8770f8775da14e109b5a8519"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"41apN691jZVadGaISnMeL+cp+ERop+X+PiIXkSDgN8cS3Wy8N8hgOP1X9LMOV9sG+radDvLz2TyuqT5VtxSeDg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-01T17:53:18.219118Z","bundle_sha256":"a1f0ec5e4b0a621000372cca28f9442d28e0e05e17ebdd8fd08b6abac1df839c"}}