{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:5KD5VPYBGQNJ5FXTZMJ7TER5X6","short_pith_number":"pith:5KD5VPYB","canonical_record":{"source":{"id":"2508.19500","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-08-27T01:11:59Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"70e6a8e72b9a228af5e3f6740aa08daa1c7d6b07efa929dd239fd19b0ec473a5","abstract_canon_sha256":"271aed470644c8f563a8c83af451a52caffc4ac8827206d8c11cac17ff654377"},"schema_version":"1.0"},"canonical_sha256":"ea87dabf01341a9e96f3cb13f9923dbf839e6cae965794c04c0bfa729f80b73e","source":{"kind":"arxiv","id":"2508.19500","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2508.19500","created_at":"2026-07-05T12:00:12Z"},{"alias_kind":"arxiv_version","alias_value":"2508.19500v1","created_at":"2026-07-05T12:00:12Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2508.19500","created_at":"2026-07-05T12:00:12Z"},{"alias_kind":"pith_short_12","alias_value":"5KD5VPYBGQNJ","created_at":"2026-07-05T12:00:12Z"},{"alias_kind":"pith_short_16","alias_value":"5KD5VPYBGQNJ5FXT","created_at":"2026-07-05T12:00:12Z"},{"alias_kind":"pith_short_8","alias_value":"5KD5VPYB","created_at":"2026-07-05T12:00:12Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:5KD5VPYBGQNJ5FXTZMJ7TER5X6","target":"record","payload":{"canonical_record":{"source":{"id":"2508.19500","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-08-27T01:11:59Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"70e6a8e72b9a228af5e3f6740aa08daa1c7d6b07efa929dd239fd19b0ec473a5","abstract_canon_sha256":"271aed470644c8f563a8c83af451a52caffc4ac8827206d8c11cac17ff654377"},"schema_version":"1.0"},"canonical_sha256":"ea87dabf01341a9e96f3cb13f9923dbf839e6cae965794c04c0bfa729f80b73e","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T12:00:12.675273Z","signature_b64":"qS/fGmn5C3KjQwa5YtXwDN4b1D9WiIgvL0LzN7xI4+xLGtpdUMYsJ7NDizqybn64j53F1CzeSVC9Dja/9BEKAQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"ea87dabf01341a9e96f3cb13f9923dbf839e6cae965794c04c0bfa729f80b73e","last_reissued_at":"2026-07-05T12:00:12.674753Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T12:00:12.674753Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2508.19500","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T12:00:12Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"LicmITNrkr0mqs2Z8Dk+KlSCZVEgZ5J5+TlAsUeUXvqT56o2xDg6NZ6xYa/tyhbYFApZCiNBfn8kd7EU0evYAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-10T02:30:50.225368Z"},"content_sha256":"98ddb18b6da1304939b64e003baeb1f931810df3c915e1c2a2627f1dbd6a9b38","schema_version":"1.0","event_id":"sha256:98ddb18b6da1304939b64e003baeb1f931810df3c915e1c2a2627f1dbd6a9b38"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:5KD5VPYBGQNJ5FXTZMJ7TER5X6","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Servant, Stalker, Predator: How An Honest, Helpful, And Harmless (3H) Agent Unlocks Adversarial Skills","license":"http://creativecommons.org/licenses/by-sa/4.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"David Noever","submitted_at":"2025-08-27T01:11:59Z","abstract_excerpt":"This paper identifies and analyzes a novel vulnerability class in Model Context Protocol (MCP) based agent systems. The attack chain describes and demonstrates how benign, individually authorized tasks can be orchestrated to produce harmful emergent behaviors. Through systematic analysis using the MITRE ATLAS framework, we demonstrate how 95 agents tested with access to multiple services-including browser automation, financial analysis, location tracking, and code deployment-can chain legitimate operations into sophisticated attack sequences that extend beyond the security boundaries of any in"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2508.19500","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2508.19500/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T12:00:12Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"tsmQzuC1wshUSrfilOSrSVV8H7GpMK94a2xgq5N9A22tmRfCGTRclCesaKaDlWdAxuUmVIswzwByd8T18x9KAg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-10T02:30:50.225949Z"},"content_sha256":"222ba5dba4b9a92e765a5fe8b3b038aed6e3e0f9fac37d544c9040e87d4df293","schema_version":"1.0","event_id":"sha256:222ba5dba4b9a92e765a5fe8b3b038aed6e3e0f9fac37d544c9040e87d4df293"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/5KD5VPYBGQNJ5FXTZMJ7TER5X6/bundle.json","state_url":"https://pith.science/pith/5KD5VPYBGQNJ5FXTZMJ7TER5X6/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/5KD5VPYBGQNJ5FXTZMJ7TER5X6/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-10T02:30:50Z","links":{"resolver":"https://pith.science/pith/5KD5VPYBGQNJ5FXTZMJ7TER5X6","bundle":"https://pith.science/pith/5KD5VPYBGQNJ5FXTZMJ7TER5X6/bundle.json","state":"https://pith.science/pith/5KD5VPYBGQNJ5FXTZMJ7TER5X6/state.json","well_known_bundle":"https://pith.science/.well-known/pith/5KD5VPYBGQNJ5FXTZMJ7TER5X6/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:5KD5VPYBGQNJ5FXTZMJ7TER5X6","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"271aed470644c8f563a8c83af451a52caffc4ac8827206d8c11cac17ff654377","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-08-27T01:11:59Z","title_canon_sha256":"70e6a8e72b9a228af5e3f6740aa08daa1c7d6b07efa929dd239fd19b0ec473a5"},"schema_version":"1.0","source":{"id":"2508.19500","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2508.19500","created_at":"2026-07-05T12:00:12Z"},{"alias_kind":"arxiv_version","alias_value":"2508.19500v1","created_at":"2026-07-05T12:00:12Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2508.19500","created_at":"2026-07-05T12:00:12Z"},{"alias_kind":"pith_short_12","alias_value":"5KD5VPYBGQNJ","created_at":"2026-07-05T12:00:12Z"},{"alias_kind":"pith_short_16","alias_value":"5KD5VPYBGQNJ5FXT","created_at":"2026-07-05T12:00:12Z"},{"alias_kind":"pith_short_8","alias_value":"5KD5VPYB","created_at":"2026-07-05T12:00:12Z"}],"graph_snapshots":[{"event_id":"sha256:222ba5dba4b9a92e765a5fe8b3b038aed6e3e0f9fac37d544c9040e87d4df293","target":"graph","created_at":"2026-07-05T12:00:12Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2508.19500/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"This paper identifies and analyzes a novel vulnerability class in Model Context Protocol (MCP) based agent systems. The attack chain describes and demonstrates how benign, individually authorized tasks can be orchestrated to produce harmful emergent behaviors. Through systematic analysis using the MITRE ATLAS framework, we demonstrate how 95 agents tested with access to multiple services-including browser automation, financial analysis, location tracking, and code deployment-can chain legitimate operations into sophisticated attack sequences that extend beyond the security boundaries of any in","authors_text":"David Noever","cross_cats":["cs.AI"],"headline":"","license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-08-27T01:11:59Z","title":"Servant, Stalker, Predator: How An Honest, Helpful, And Harmless (3H) Agent Unlocks Adversarial Skills"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2508.19500","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:98ddb18b6da1304939b64e003baeb1f931810df3c915e1c2a2627f1dbd6a9b38","target":"record","created_at":"2026-07-05T12:00:12Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"271aed470644c8f563a8c83af451a52caffc4ac8827206d8c11cac17ff654377","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-08-27T01:11:59Z","title_canon_sha256":"70e6a8e72b9a228af5e3f6740aa08daa1c7d6b07efa929dd239fd19b0ec473a5"},"schema_version":"1.0","source":{"id":"2508.19500","kind":"arxiv","version":1}},"canonical_sha256":"ea87dabf01341a9e96f3cb13f9923dbf839e6cae965794c04c0bfa729f80b73e","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"ea87dabf01341a9e96f3cb13f9923dbf839e6cae965794c04c0bfa729f80b73e","first_computed_at":"2026-07-05T12:00:12.674753Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T12:00:12.674753Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"qS/fGmn5C3KjQwa5YtXwDN4b1D9WiIgvL0LzN7xI4+xLGtpdUMYsJ7NDizqybn64j53F1CzeSVC9Dja/9BEKAQ==","signature_status":"signed_v1","signed_at":"2026-07-05T12:00:12.675273Z","signed_message":"canonical_sha256_bytes"},"source_id":"2508.19500","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:98ddb18b6da1304939b64e003baeb1f931810df3c915e1c2a2627f1dbd6a9b38","sha256:222ba5dba4b9a92e765a5fe8b3b038aed6e3e0f9fac37d544c9040e87d4df293"],"state_sha256":"2048dc1d12dc763e67271609f737ce5121f1d7d45a250f5c6d4cd9d0665df63c"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Y6xr+3k9AnB9lImYCa1eS9whqhdVZXXVsMHhvT2xY8nWkITWHLEq1qDTDJG2aqZVoOdzONN+I41Mrk4HiTDJCA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-10T02:30:50.229939Z","bundle_sha256":"02fd6a6e9292780d33ece789a6c1e2d1820140dfa4035b0daa3b55a6f26f5190"}}