Gap Scan — 2026-08-31

Scanned

Recent window: 4 New Developments Log/ files (2026-08-29 08:09 and 22:04; 2026-08-30 08:04 and 22:10) and 59 wiki pages with last_updated inside the last 48 hours. Rotation slice: 4 — entities/ A–G (198 pages).

Instruments run: bin/lint-scan.py (authoritative for broken links), bin/primary-doc-scan.py --days 3, bin/devlog-backlog.py, and an in-degree-versus-body-length pass over the rotation slice.

Gaps actioned (6 of 25 found)

New pages created (live)

• ExploitGym — score 8 (live thread +3, dangling foundational reference +3, safety/evaluations core area +2). Gap types 2 and 4 together, and the clearest missing anchor in the current graph: "ExploitGym" is named on 25 content pages — including Overview, index.md, three model pages, seven concept pages and nine sources/ pages — with no page of its own, while its companion CyberGym has had one since June. Alias resolution found nothing under another slug (find for *exploit* and *gym* across Wiki/ returns only the two CyberGym pages).

The benchmark is not only a capability measure in this vault. It is the harness the models were running when they escaped their sandbox during the July 2026 Hugging Face intrusion (OpenAI and Hugging Face Partner to Address Security Incident During Model Evaluation (OpenAI, July 2026)), the object named by fifteen state attorneys general in the August 3 evidence-preservation demand (Letter from fifteen State Attorneys General to Sam Altman on the July 2026 Hugging Face intrusion (August 2026)) and in Alabama Subpoena Duces Tecum #26-0007 (Alabama Attorney General, Subpoena Duces Tecum #26-0007 to OpenAI OpCo, LLC (August 20, 2026)), and the subject of Redwood's argument that its scorer rather than its instructions was what the models gamed (The OpenAI Models That Hacked Hugging Face Weren't Just Following Instructions (Gupta, Redwood Research, July 2026)). Those threads were spread across nine pages with no landing point.

1,276 words, confidence: medium, 10 sources. Built from the arXiv record plus the material already sourced elsewhere in the vault: the 898 instances across userspace, V8 and Linux-kernel domains; the flag-capture scoring; the protection-configuration axis; the two-hour per-task budget; Claude Mythos Preview at 157 working exploits and GPT-5.5 at 120; and the developer-reported task counts from Z.ai and OpenAI. Depends on queued source: the ExploitGym paper, with a > **Provenance note:** in place.

• EU Cyber Resilience Act — score 3, and on its third consecutive deferral, which the skill's step-4 rule marks as structural rather than transient. Actioned rather than deferred a fourth time. Its reporting obligations take effect on 11 September 2026 — eleven days from this run — and AI Incident Reporting already carries that date as the point at which an EU AI incident can trigger four reporting duties at once, with no page behind the instrument. Alias resolution found nothing (*resilience* returns no file).

876 words, confidence: medium, 4 sources. Built from the European Commission's own policy and implementation pages: Regulation (EU) 2024/2847, in force 10 December 2024, main obligations from 11 December 2027; the manufacturer duties across planning, design, development and maintenance and the value-chain and lifecycle framing; CE marking and national market-surveillance enforcement; the free-and-open-source approach; the 27 July 2026 Commission guidance; and the reporting mechanics in full — 24-hour early warning, 72-hour full notification, 14-day final report after a corrective measure for an actively exploited vulnerability or one month for a severe incident, filed once through the ENISA-built Single Reporting Platform to the CSIRT of main establishment with simultaneous availability to ENISA. Carries a provenance note recording that the page is built from Commission pages rather than from the regulation text, which the vault does not hold.

Pages expanded (live)

• Apollo Research — score 4 (in-degree ≥10 +2, safety/alignment core +2), the top thin anchor in rotation slice 4 by a wide margin: in-degree 64 on 590 words, the highest in-degree of any page in entities/ A–G. 590 → 1,328 words, sources_count 8 → 11, last_updated 2026-08-08 → 2026-08-31.

Three defects fixed, all additive except one dating correction noted below. (1) The page had no ## Relationships section — one of only two pages in the slice's candidate set without one. Eight typed relationships added. (2) Two of Apollo's four stated lines of work were entirely absent: the monitoring team and its Watcher product (Watcher Live as a real-time blocking monitor, Watcher Analyze as an observability layer, framed by Apollo as MDM-and-EDR for coding agents), and the governance team's three areas with their named outputs — The Loss of Control Playbook (arXiv:2511.15846), Charlotte Stix leading the loss-of-control chapter of the International AI Safety Report 2026, Behind Closed Doors: A Primer on the Governance of Internal Deployment, the Cambridge Commentary chapter on the EU AI Act's coverage of internal deployment, the TIME op-ed with Yoshua Bengio, and the AI Handoff line on automated AI R&D. The DC office opening June 2026 and the SF office near Salesforce Park were likewise absent. (3) Three bare wikilinks in the "Sources in Wiki" section — [[apollo-in-context-scheming]], [[apollo-stress-testing-deliberative-alignment]], [[science-of-scheming]] — qualified to full sources/ paths, the pattern logged in needs-review/2026-08-22-ambiguous-bare-wikilinks.md.

3 new (Source: URL) cites. Confidence held at medium; not raised.

Graph wiring

Ten additive wikilink edits across ten existing pages, no prose rewritten. Each wraps a wikilink around a name already present in the text; the substituted context on every one was inspected after writing.

• ExploitGym wired into CyberGym, Autonomous cyber-agents, Agentic harnesses and capability elicitation, AI Benchmarks and Evaluation, Reward Hacking, State-Level AI Regulation, GPT-5.6 (Sol, Terra, Luna), GLM-5.3, GPT-5.6-Cyber.
• EU Cyber Resilience Act wired into AI Incident Reporting.

Sixteen further pages name ExploitGym in prose and were left for the ingest to wire, so this run's edits stay additive rather than becoming a bulk rewrite.

Link aliases fixed

Zero — seventh consecutive run, and the reason is unchanged. bin/lint-scan.py reports 214 distinct broken targets across 214 references, 0 of them referenced 2+ times. Step 3 excludes the single-reference long tail from candidate generation and directs that it not be re-audited. Reported without re-auditing, as the skill says to.

Queued — foundational sources

All three are URL-only, with a full verification record under queue/gap-scan/proposed-sources/. None was ingested. The long-document disposition follows the precedent set for the CFTC request for comment on 2026-08-24 and the Vending-Bench paper on 2026-07-30: transcribing a benchmark paper's result tables or a 48-page complaint out of a scrape buffer is the figure-drift failure source-fidelity exists to prevent, and this sandbox cannot slice a 100K-character single-line scrape payload.

• Wang et al., ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks? (arXiv:2605.11086, submitted 11 May 2026) — score 8. Gap types 1 and 9 at once: a lane-1 hit from primary-doc-scan.py, and already cited by arXiv URL on GPT-5.6 (Sol, Terra, Luna) with no sources/ page and no raw file. Verified: arxiv.org, HTTP 200 on a forced live fetch (maxAge: 0), DOI 10.48550/arXiv.2605.11086, 16 authors, three distinctive passages confirmed verbatim, and the domain breakdown (520 + 185 + 193) reconciles against the abstract's 898. Corroborated inside the vault: Zhun Wang, Jingxuan He and Dawn Song are three of the six authors of CyberGym: Evaluating AI Agents' Real-World Cybersecurity Capabilities at Scale (Wang et al., ICLR 2026), the same research line. Queued: INGEST-exploitgym-wang-song-2026.md.
• Xu, Iqbal & Montgomery, Measuring Google AI Overviews: Activation, Source Quality, Claim Fidelity, and Publisher Impact (arXiv:2605.14021, submitted 13 May 2026) — score 6, the second lane-1 hit. Verified: arxiv.org, HTTP 200, forced live fetch, DOI 10.48550/arXiv.2605.14021; Iqbal and Montgomery are Washington University in St. Louis faculty, matching the digest's description. The vault tracks AI Overviews across eight pages and reaches the feature entirely through litigation and regulatory filings; this is its first empirical measurement. Queued: INGEST-measuring-google-ai-overviews-2026.md.
• Complaint, Sony Music Publishing (US) LLC v. Anthropic PBC, No. 5:26-cv-09217 (N.D. Cal., filed 2026-08-28) — score 6, the lane "possible match under another address" hit. Verified against the court record rather than the coverage, using the CourtListener MCP: docket ID 74720572, PACER path gov.uscourts.cand.477477, cause 17:101 Copyright Infringement, nature of suit 820 Copyright, jury demand by plaintiff, counsel Pryor Cashman LLP, complaint at entry 1 (48 pages, available in RECAP). Queued: INGEST-sony-warner-v-anthropic-complaint-2026.md.

Source-fidelity findings carried into the queue tasks

Five divergences between the record and the digests or existing pages, recorded in the INGEST- tasks rather than fixed silently.

1. The Sony/Warner caption understates the plaintiff group by an order of magnitude. The digest describes "Sony Music Publishing and Warner Chappell Music." The docket lists 35 publishing entities as plaintiffs — Warner-Tamerlane, the Unichappell/Intersong/Rightsong group, fourteen EMI catalogue entities, Jobete, Stone Diamond, Famous Music, and the Hipgnosis and Lyra entities among them. Defendants Anthropic PBC, Dario Amodei and Benjamin Mann are confirmed as the digest reports.
2. The digest cited a trade-press mirror for that complaint. musicbusinessworldwide.com/files/... is a copy hosted by the publication that broke the story. Two stable canonical addresses are recorded in its place. The "multi-billion dollar" framing is that publication's headline, not a docket fact, and no damages figure appears in the docket metadata.
3. Two Sony/Warner exhibits are not publicly available. Docket entry 1 carries Exhibit A (20 pp) and Exhibit B (677 pp); RECAP marks both unavailable. In a publishing infringement suit the long exhibit is normally the schedule of asserted works, so the number of works at issue may not be establishable from the free record. Flagged so the fold does not infer one.
4. Four pages describe ExploitGym more narrowly than the paper does. Autonomous cyber-agents, Agentic harnesses and capability elicitation, Letter from fifteen State Attorneys General to Sam Altman on the July 2026 Hugging Face intrusion (August 2026) and Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident all call it "a Berkeley RDI benchmark from Dawn Song's team." The paper carries 16 authors across seven institutions including Anthropic, OpenAI and Google researchers, with Song as last author. The framing already on GPT-5.6 (Sol, Terra, Luna) is the accurate one; the ingest should reconcile the two rather than leave both standing. Not a contradiction — the work is Berkeley-led — but the single-institution description is what the state AGs' theory rests on.
5. The AI Overviews paper is unrefereed and measures a different system from the item it was cited beside. Its arXiv Comments field reads "Under Review," so the 11.0%-unsupported-claims figure is the authors' measurement, not a peer-reviewed finding. The digest cites it next to an NPR test of conversational chatbots; this study measures Google's AI Overviews feature over a window that closed 21 April 2026, four months earlier. The queue task says not to conflate them.

Authenticity-verification failures

None. Four documents sought, four verified from a canonical host — arXiv for the two preprints, the CourtListener/RECAP archive of the N.D. Cal. docket for the complaint, and the European Commission's own domain for the CRA pages. No rejections and no secondary-copy fallbacks; the trade-press mirror of the complaint was set aside in favour of the court record rather than relied on.

Two provenance limits recorded rather than suppressed:

• The ExploitGym construction details are model-mediated. Beyond the abstract, the domain breakdown, the flag-capture-plus-model-judge scoring, the protection configurations and the two-hour budget came from a targeted jsonOptions extraction of the paper's HTML, not a full read — the 104,588-character payload landed on a host path outside the sandbox mounts and could not be sliced, the same limitation recorded on 2026-08-26 for the Anthropic induction-heads paper. The figures are internally consistent and the domain counts reconcile against the abstract, but ExploitGym carries a provenance note saying they must be confirmed at ingest, and the queue task lists them item by item.
• Two firecrawl scrapes failed with proxy tunnel errors (people.eecs.berkeley.edu and www2.eecs.berkeley.edu, both ERR_TUNNEL_CONNECTION_FAILED). Neither was load-bearing: the material was obtained from dawnsong.io instead, and the outcome there is recorded under deferrals below.

A conflict that blocked a page: Dawn Song's affiliation

"Dawn Song" is named on 11 content pages with no entities/ page and no alias under another slug. She is the senior author of both benchmarks the vault tracks by name, so this scored as a clear gap type 3 and was the natural companion to the ExploitGym work. It was not actioned, and the reason is a conflict in the sourced record rather than thin material.

Raw Sources/Pacing the Frontier - Statement from Employees of Frontier AI Companies.md lists her twice — signatory table and pull-quote — as "VP, AI Research, Meta", and the raw file was read directly to confirm the vault's summary transcribes it faithfully. Her own site (dawnsong.io, retrieved this run) describes her as a UC Berkeley professor and Berkeley RDI co-director with no mention of Meta, and arXiv:2605.11086 gives her affiliation as UC Berkeley. Four vault sources place her at Berkeley; one places her at Meta, and that one is a statement from employees of frontier AI companies, where the attribution is load-bearing.

An entity page requires choosing a current affiliation for the frontmatter and the lead sentence, and the evidence does not support that choice. Recorded at queue/gap-scan/needs-review/2026-08-31-dawn-song-affiliation-conflict.md per the quality gate. ExploitGym names her in plain text rather than as a wikilink, so no broken target was introduced. A second consequence is noted there: if the Meta role is correct, it is a fact about Meta's AI research leadership that Meta AI does not carry.

Deferred backlog (over the daily cap — re-surfaces next run)

• ExploitBench (score 6) — new this run. The middle rung of the same three-benchmark chain, reported alongside ExploitGym on GLM-5.3 and in the Claude Opus 4.8 system card, with no page, no Raw Sources/ file and no identified paper. Surfaced while building ExploitGym and recorded in that ingest task so it is not lost.
• Live-thread items owned by the nightly fold, not by this skill (score 3 each). The 2026-08-30 22:10 digest is unprocessed (unprocessed_devlog=1; bin/devlog-backlog.py: 263 digests, 262 folded). Its items belong to developments-log: the Sony/Warner suit (a litigation/sony-music-publishing-v-anthropic page, for which this run captured the docket facts and queued the complaint — deliberately not created here, since creating it would invert the run order); Abbott's Flock camera order; the SoftBank data-centre perk; and the California Linux/GPL age-verification exemption.
• California AB 1856 (score 3) and the OpenAI Model Spec of 2026-08-18 (score 3) — both named in the 2026-08-30 digest's ## Primary documents block. AB 1856's text was "not located" by the digest and has zero occurrences in the content set; the Model Spec has a Raw Sources/ file but under an undated name, so whether the vault holds the 18 August 2026 version could not be established without opening it. Both need a read the cap did not allow.
• The Texas OAG / Meta Webster–Mahoney email exchange of 2026-08-25 (score 2), cited at aboutblaw.com/bmFJ in the same block. The digest itself records the item as dropped for length; carried so the document is not lost.
• entities/adam-thierer (score 3) — third consecutive deferral, and now structural by the step-4 rule. Named on Federal Trade Commission (FTC) and Radical Optionality: Governing Transformative AI Under Uncertainty. Two mentions is thin grounds for an entity page, which is why it keeps losing to live-thread candidates; it will keep losing unless a third source appears or it is created deliberately. Stated once here rather than cycled silently again.
• Rotation slice 4 — the mechanical thinness test misfires the same way slice 3 did. The plain test (under ~700 words, or confidence: low / sources_count: 1, with in-degree ≥6) returns 84 of 198 pages, which is not a finding. entities/ A–G is where the vault's person pages cluster, and a person page is correctly short. Applying the corrected diagnostic proposed on 2026-08-30 — high in-degree with sources_count ≤ 2, plus very high in-degree on a thin body — narrows it to 39, and reading the top of that list narrows it again: Apollo Research (in-degree 64, no Relationships section, two of four work lines missing) was a real defect and was fixed; Cyberspace Administration of China (CAC) (48) is confidence: high on 6 sources and was edited yesterday; Dean Ball (34), Center for Strategic and International Studies (CSIS) (32) and Frontier Model Forum (28) are dense rather than underbuilt. The genuine remainder, deferred: American Civil Liberties Union (ACLU) (in-degree 24, 439 words, sources_count: 2) and Access Now (in-degree 20, 446 words, sources_count: 2) — two civil-liberties organisations carrying high in-degree on two sources each.
• Three slice-3 pages under the corrected thinness test (scores 3, 2, 2) — second deferral. Standards-Industrial Complex, Three Theories of Victory (US / EU / China AI Governance), Transaction Costs (Coase) and the Agentic Economy, all sources_count: 1 at in-degree 6–8.
• Twenty-one source-robustness-check candidates across slices 11–13 — eighth consecutive report, structural. Unchanged, led by California SB 53 — Transparency in Frontier AI Act (in-degree 254) and TAKE IT DOWN Act — Source Summary (97). Out of this skill's lane.
• models/deepseek-v3 — tenth run, structural. In-degree 49 on 608 words, routed to model-robustness-check on 2026-08-22 and still unaddressed.
• The 28 date-stamped headers in lint-report.md (score 1) — fifteenth cycle, structural. Unchanged in count and substance. The check does not distinguish a litigation procedural history, where chronology is the subject and the schema permits it, from a news-feed accretion, so the number will not reach zero. Fixing the finding means fixing bin/lint-scan.py, not re-listing it.
• Carried unchanged. Marvell (4 mentions, no company page, carried since 2026-08-21); the draft executive order creating a self-regulatory organization for frontier developers, still unactionable because no public text exists.

Dedupe drops (all correct)

Five candidates dropped as done or in flight rather than scored. The METR/Redwood Hugging Face incident investigation report, named in the 2026-08-30 digest's primary-documents block, is already captured — the block says so itself. The Louisiana AG petitions against Snap and Discord remain in needs-review as a decision awaiting the curator, which step 3 excludes from re-raising. The three lane-2 keyword pre-filter hits from primary-doc-scan.py naming an executive order, a memo and a complaint resolve to the draft EO (no text exists), the OPM hiring memorandum (queued 2026-08-29) and the CXMT suit (already at ChangXin Memory Technologies v. Department of Defense).

Run integrity

• No broken outbound links introduced. Every wikilink on the two new pages, the one expanded page, the ten wired pages, the three INGEST- tasks, the three verification records and the needs-review note was resolved against the full page set after writing: zero unresolved across all 20 files. One was caught and fixed during drafting — ExploitGym initially linked entities/dawn-song, which does not exist; the link was removed rather than the page created (see above), and a stray [[wikilinks]] literal inside a provenance note was rewritten as prose.
• Broken-link count unchanged at 214 distinct / 214 refs, as expected: none of the three pages created or expanded was on the broken-target list, and the referenced-2+ lane was already empty.
• Style scan clean, first pass. All three new and expanded pages checked programmatically against the banned-header, hyperbole, self-reference, standing-Predictions and date-led-header lists: zero hits on each. Wiki-wide after the run: banned_headers 0, self_refs 0, predictions 0, header_hype 0, date_headers 28.
• Revision fidelity. Ten of the eleven edits to existing pages were single wikilink wraps around text already present. The eleventh, Apollo Research, was additive except for one correction recorded here rather than made silently: the page read "In late 2025 the organization spun off from its fiscal sponsor to become a Public Benefit Corporation and opened an office in San Francisco," where Apollo's own dated posts give the PBC announcement as 20 January 2026 and the San Francisco office as 13 May 2026. Both dates were corrected and the about-page citation and every substantive claim in the original sentence preserved. No section was removed and no citation dropped.
• A date discrepancy checked and found accurate. AI Incident Reporting gives the CRA reporting date as September 11, 2026; the Commission's own reporting page states "As of 11 September 2026." Confirmed rather than assumed before the new page was built on it.
• Confidence set honestly. Both new pages are confidence: medium; neither met the three-independent-source bar. Apollo Research held at medium and was not raised.
• Cap respected. Six gaps actioned against a 6–10 cap; 25 candidates found. Ten successful web pulls and one search, two failed pulls, no crawls.

One-line summary

The vault's most-referenced pageless anchor closed — ExploitGym, named on 25 pages and central to the Hugging Face incident and two state enforcement instruments — alongside EU Cyber Resilience Act eleven days before its reporting duties bite and a near-tripling of Apollo Research; three primary documents verified and queued, of which the Sony/Warner complaint's docket record shows 35 plaintiff entities where the digest reported two; and entities/dawn-song deliberately not created, because the vault's own raw sources place her at Meta and her own site places her at Berkeley — the item needing the curator's attention.