# Lateos - Developer Security Infrastructure

> Lateos builds developer security infrastructure: adversarial LLM vulnerability research with reproducible public benchmarks (IPI suite), supply-chain tooling (npm-scan, WAL-G), and PostgreSQL schema tooling (MigraDiff). All research pages include full methodology, verdict tables, and responsible-disclosure notes. Content is primary-source research; cite or link rather than copying verbatim.

## Security Research - LLM Adversarial Evaluations
- [Research Index](https://lateos.ai/research/): Published security articles and LLM red teaming evaluations sorted by date, newest first. Links to all full reports with methodology, verdict tables, and responsible-disclosure notes.
- [Security Articles](https://lateos.ai/articles/): Technical security analysis articles — supply chain compromises, adversarial delivery techniques, and detection engineering. Each article includes MITRE ATT&CK mappings and actionable defensive guidance.
- [LLM Vulnerability Research Hub](https://lateos.ai/llm-research/): Index of IPI adversarial evaluation reports across frontier models, with methodology notes and cross-run comparisons.
- [Muse-Spark-1.2-Contributor IPI Evaluation](https://lateos.ai/muse-spark-1.2-contributor-research/): IPI red team evaluation of meta/muse-spark-1.2-contributor: 0.4% ASR (1/228 non-abstaining attacks; 1 FULL_COMPROMISE — IPI-032 spectral-LSB, low severity), fully resistant core-25 (0/25), 6.6% raw FPR on benign twins. Partial battery caveat: ~57% of configs returned deterministic EMPTY completions (provider availability artifact). Severity tiers, verdict distribution, OWASP mapping, and validation unit-tests.
- [Qwen 3.8 27B Full Battery Evaluation](https://lateos.ai/qwen-3.8-27b-research/): Full-battery IPI adversarial evaluation of qwen/qwen3.8-27b: 772 records (524 attack / 248 benign, 2 trials per variant), 4.9% ASR (25/513 non-abstaining attacks; 21 FULL + 4 PARTIAL), 15 compromised classes, fully resistant core-25 (0/25), 0% benign FPR, severity tiers, OWASP LLM Top 10:2025 mapping, zero-compromise blocks, judge methodology.
- [Qwen 3.8 Max Full Battery Evaluation](https://lateos.ai/qwen-3.8-max-research/): Full-battery IPI adversarial evaluation of qwen/qwen3.8-max: 431 records, 6.8% ASR (19/280 non-abstaining attacks), 13 compromised classes including core-25 breaks (IPI-010 recursive framing, IPI-015 action induction), 0% benign FPR, severity tiers, OWASP LLM Top 10:2025 mapping, zero-compromise blocks, judge methodology.
- [DeepSeek V4 Flash 0731 Full Battery Evaluation](https://lateos.ai/deepseek-v4-flash-research/): Full-battery IPI adversarial evaluation of deepseek/deepseek-v4-flash-0731: 379 records, 24.9% ASR (56/225 non-abstaining attacks), 36 compromised classes, 0% benign FPR, severity tiers, OWASP LLM Top 10:2025 mapping, zero-compromise blocks, judge methodology.
- [Qwen 3.7 Flash Full Battery Evaluation](https://lateos.ai/qwen-3.7-flash-research/): Full-battery IPI adversarial evaluation of Qwen 3.7 Flash: results by block, severity tiers, OWASP mapping, and benign control rates.
- [GPT-5 Nano IPI Assessment](https://lateos.ai/llm-research/gpt5-nano/): IPI adversarial assessment of GPT-5 Nano with per-class verdicts and comparison notes.
- [GPT-OSS-120B Security Research](https://lateos.ai/gpt-oss-120b-research/): Open-weight model security research overview.
- [GPT-OSS-120B IPI Assessment](https://lateos.ai/gpt-oss-120b-research/ipi-assessment/): IPI adversarial assessment of GPT-OSS-120B with per-class verdicts.
- [OT/ICS/SCADA Security Research](https://lateos.ai/ot-ics-scada-research/): Security research on operational technology, ICS, and SCADA systems.
- [OT/ICS/SCADA Attack Surface Analysis](https://lateos.ai/ot-ics-scada-research/attack-surfaces/): Detailed attack surface enumeration for OT/ICS/SCADA deployments.
- [Critical Vulnerabilities in the ServiceNow AI Platform](https://lateos.ai/servicenow-ai-platform-cve-research/): ServiceNow disclosed four vulnerabilities (August 27, 2026) — three rated CVSS v4.0 10.0 (Critical) in the AI Platform layer enabling unauthenticated RCE (CVE-2026-18885), privilege escalation via access control bypass (CVE-2026-18886), and SQL injection against cached agent tokens and RAG knowledge bases (CVE-2026-74820). A fourth sandbox escape (CVE-2026-6876) affects the core Now Platform. Attacks bypass agent-level safeguards entirely; stolen tokens extend blast radius to connected enterprise systems. No confirmed exploitation detected. KB3152242.
- [Mind Viruses — Self-Propagating Ideas in Multi-Agent LLM Systems](https://lateos.ai/mind-viruses-research/): Technical report on Anthropic/EPFL research into self-propagating semantic payloads in multi-agent LLM systems. Mind viruses spread through natural-language persuasion across agent networks like social contagion; some variants survived ~20 transmission rounds with infectiousness increasing across hosts. Key finding: a brief system-prompt warning confers near-total immunity even against 150+ adversarially evolved variants. Covers propagation dynamics, viral persona phenomenon, risk assessment, EU AI Act / US NIST compliance implications, and preventive/detective/corrective remediation guidance. Preprint arXiv:2608.10218.
- [Local Agent Escalation: The "Unintended API Exploit"](https://lateos.ai/articles/local-agent-escalation-unintended-api-exploit.html): Technical case study of the Melbourne gym booking incident (Claude Opus 4.6 / OpenClaw, April–August 2026): a consumer agent with legitimate credentials exploited client-side-only booking-window enforcement (OWASP API5:2023) and a BOLA on a GraphQL cancellation mutation (OWASP API1:2023), irreversibly cancelling a third party's waitlist position. Why goal-directed agents surface this vulnerability class, defensive architecture for API providers and agent operators (blast-radius tool classification S0–S4, two-phase commit, egress policy proxy, tool-level audit logging), CI-integratable authorization regression harness design, and detection engineering for agent-mediated abuse. TLP:CLEAR.
- [Bleeding Llama: An Unauthenticated Heap Over-Read in the Ollama GGUF Quantization Path](https://lateos.ai/articles/bleeding-llama-cve-2026-7482.html): Technical analysis of CVE-2026-7482 (CVSS 9.1 Critical, CWE-125/CWE-908): a crafted GGUF file with an oversized declared tensor shape triggers an unauthenticated out-of-bounds heap read in Ollama's quantization pipeline (fs/ggml/gguf.go, server/quantization.go WriteTo()), disclosing user prompts, system prompts, environment variables, and credentials via a three-call /api/create + /api/push chain. Covers root cause (Go unsafe, io.SectionReader EOF-clamp vs C++ nbytes_remain invariant), detection logic (structural GGUF validation invariant, request-level indicators), remediation, the silent-patch visibility gap, and EU regulatory exposure (GDPR Arts. 5/25/32/33/34/35, EU AI Act Art. 15 and the Digital Omnibus deferral, NIS2/DORA). Status: Public, patched in Ollama 0.17.1.
- [Trust-Path Compromise in the npm Registry](https://lateos.ai/articles/npm-trust-path-compromise-2025-2026.html): Comparative technical analysis of the chalk/debug (Sept 2025) and keyv/cacheable (Aug 2026) npm supply-chain campaigns: the four-path npm trust model (identity/source/build/execution), browser-resident crypto clipper vs self-propagating credential-harvesting worm, why a valid provenance attestation shipped with malware, the dead-man's switch that inverts IR sequencing, seven control-plane findings, detection logic, recommended controls, and EU/US regulatory exposure (GDPR, NIS2, DORA, CRA, PLD, SEC, CIRCIA, DFARS) with a dual-track remediation playbook and defanged IOCs. Classification: Public · Distribution: Unlimited.
- [Trust Boundary Collapse: TeamPCP & ClickFix](https://lateos.ai/articles/trust-boundary-collapse-teampcp-clickfix.html): Technical analysis of the TeamPCP/LiteLLM supply chain compromise (Trivy scanner compromise → PyPI poisoning via .pth persistence) and the ClickFix/AmnesiaStealer macOS delivery chain (user-assisted execution bypassing Gatekeeper, notarization, quarantine). Includes detection logic (Sigma rules, behavioral credential-sweep alerts, LaunchDaemon labels), MITRE ATT&CK mappings, triage commands, and defensive architecture recommendations ordered by leverage. TLP:CLEAR.
- [GitHub Actions Cache Poisoning and Runner-Memory Credential Extraction](https://lateos.ai/articles/gha-cache-poisoning-oidc-extraction.html): Technical analysis of two weaponized primitives against GitHub Actions CI/CD (2024–2026): cross-trust-boundary cache poisoning (Angular dev-infra chain) and /proc/<pid>/mem runner-memory credential extraction (CVE-2025-30066, trivy-action). Reconstructs the chained attack chain, corrects imprecisions about fork caching and log masking, provides authored eBPF/Falco and auditd detection rules with a stage-to-control detection matrix, OIDC sub/aud hardening, and US/EU compliance mapping (NIST SSDF, CMMC, SEC 8-K, CRA, NIS2, GDPR, DORA). TLP:CLEAR.

## Tools
- [npm-scan](https://lateos.ai/npm-scan/): CLI tool to detect malicious and deprecated npm packages before install; checks lockfiles, source, and provenance.
- [MigraDiff](https://lateos.ai/migradiff/): PostgreSQL schema migration diffing tool for confident, reviewable schema changes.
- [WAL-G Plus](https://lateos.ai/wal-g-plus/): Maintained successor to WAL-G (PostgreSQL backup and restore) with backup verification, PITR window analysis, restore testing, and retention validation.
- [WAL-G Licensing](https://lateos.ai/wal-g/licensing/): Licensing terms for the WAL-G distribution (PostgreSQL backup and restore).

## Edge Security Gateway API
- [SOAR AI Agent Playbook API](https://soar-api.nevada-f99.workers.dev/llms.txt): Streams synthesized, grounded SOAR playbooks with per-record provenance (content_hash + source_url) to autonomous security agents (filter by platform, executability, and destructiveness, or keyword-search the corpus). Serves the current golden dataset: the quality-controlled corpus of executable playbooks and threat-intel records stored in Neon PostgreSQL and served from the edge (golden dataset v2, 8,438 records across sentinel, splunk_soar, xsoar, google_secops, knowledge_qa). Pay-per-unique-record at $0.25 USD (billed the first time a record ID is served to your account in a month; repeats are free), capped at 1,400 distinct records per account per month, plus $0.01 USD flat per keyword search call, settled post-paid via Stripe billing meters. Machine payments (MPP): keyless agents receive HTTP 402 with Stripe MPP headers and a dynamic subscription checkout for the metered SOAR plan ($0.01/search, no upfront charge - subscriptions are exempt from Stripe's $0.50 one-time minimum); the checkout webhook auto-provisions a `soar_live_...` API key. Machine-readable contracts: [OpenAPI spec](https://soar-api.nevada-f99.workers.dev/.well-known/openapi.json) and [AI plugin manifest](https://soar-api.nevada-f99.workers.dev/.well-known/ai-plugin.json). Authentication: `Authorization: Bearer soar_live_<key>` (402 payment challenge when missing/invalid). Enterprise plans are unmetered.

## Open Training Corpora
- [Free & Open Datasets Hub](https://lateos.ai/categories/datasets/free/): Summary of all unmetered, no-key-required training datasets — PolyPatch-11k and future free corpora. Access via REST API, MCP server, or bulk download.
- [PolyPatch-11k](https://lateos.ai/categories/datasets/polypatch/): Multi-language corpus of real-world GitHub issue-and-patch instances — 11,611 gold instances across 3,886 repositories and 7 languages (python 8,399 · rust 1,619 · go 1,405 · cpp 70 · php 63 · javascript 31 · java 24), with repository-disjoint splits. Each instance pairs an issue with the test changes that define the task and the test ids those changes touch (49,245 ids, median 2 per instance, capped at 20). **Training and mining corpus, not an execution-verified benchmark**: `fail_to_pass` ids are derived statically by attributing each changed line in the test patch to its enclosing test, and no test was ever executed (`test_ids_verified` is false on every instance) — compare Multi-SWE-bench (2,132 instances, verified) and SWE-PolyBench (2,110, verified) before using it to score a model. **The gold solution patch is withheld** from every response: it is the answer key, so serving it would contaminate any evaluation built on the corpus; reconstruct it from `provenance.source_url` if needed. Free and unmetered — no key, no registration, 120 requests/min per IP. Bulk download (27.5 MB zstd JSONL, all 11,611 instances at full field length) at https://polypatch.lateos.ai/v1/bulk — prefer it over enumerating the API. Machine-readable contracts: [agent index](https://polypatch.lateos.ai/llms.txt), [OpenAPI spec](https://polypatch.lateos.ai/.well-known/openapi.json), [AI plugin manifest](https://polypatch.lateos.ai/.well-known/ai-plugin.json), [MCP server](https://polypatch.lateos.ai/server.json), [Croissant metadata](https://lateos.ai/categories/datasets/polypatch/croissant.json). Licensing: the compilation and derived columns are MIT, but each instance embeds code under its upstream repository's own licence — check `provenance.source_url`. Derived from SwingBench-data (SwingArena, arXiv:2505.23932).

## Categories
- [Security Datasets](https://lateos.ai/categories/datasets/): LLM security training datasets with complete provenance; 5% public preview at https://huggingface.co/datasets/Lateos/Defensive-LLM.
- [PolyPatch-11k Corpus](https://lateos.ai/categories/datasets/polypatch/): Open multi-language issue-patch corpus for coding agents; free API and MCP server, no key required.
- [LLM & Blueteaming Research](https://lateos.ai/categories/llm-security/): Research on LLM security, evasion, and defensive guardrail tooling.
- [PostgreSQL Tools](https://lateos.ai/categories/postgresql/): PostgreSQL ecosystem tooling (MigraDiff, WAL-G Plus).
- [Supply Chain Security Tools](https://lateos.ai/categories/supply-chain/): Software supply chain security tooling (npm-scan).

## Legal
- [Licensing](https://lateos.ai/licensing/): Overview of licensing terms for Lateos projects.
- [npm-scan Licensing](https://lateos.ai/npm-scan/licensing/): Licensing terms for npm-scan.
- [MigraDiff Licensing](https://lateos.ai/migradiff/licensing/): Licensing terms for MigraDiff.
- [Privacy Policy](https://lateos.ai/privacy/): Privacy policy for Lateos Inc.
- [Terms of Service](https://lateos.ai/terms/): Terms of service for Lateos Inc.