{
  "generated_at": "2026-09-25T00:00:00Z",
  "total": 57,
  "byBasis": {
    "real-use": 36,
    "attempted": 1,
    "demonstrated": 20
  },
  "byQuarter": [
    {
      "quarter": "2024-Q2",
      "real-use": 0,
      "attempted": 0,
      "demonstrated": 1
    },
    {
      "quarter": "2025-Q2",
      "real-use": 0,
      "attempted": 0,
      "demonstrated": 1
    },
    {
      "quarter": "2025-Q3",
      "real-use": 3,
      "attempted": 1,
      "demonstrated": 6
    },
    {
      "quarter": "2025-Q4",
      "real-use": 1,
      "attempted": 0,
      "demonstrated": 1
    },
    {
      "quarter": "2026-Q1",
      "real-use": 3,
      "attempted": 0,
      "demonstrated": 2
    },
    {
      "quarter": "2026-Q2",
      "real-use": 1,
      "attempted": 0,
      "demonstrated": 2
    },
    {
      "quarter": "2026-Q3",
      "real-use": 28,
      "attempted": 0,
      "demonstrated": 7
    }
  ],
  "byHarness": [
    {
      "name": "claude-code",
      "count": 9
    },
    {
      "name": "unnamed",
      "count": 8
    },
    {
      "name": "claude",
      "count": 7
    },
    {
      "name": "openai-rl-training-agent",
      "count": 6
    },
    {
      "name": "cursor",
      "count": 5
    },
    {
      "name": "codex-cli",
      "count": 4
    },
    {
      "name": "gemini-cli",
      "count": 4
    },
    {
      "name": "anthropic-cyber-evaluation",
      "count": 3
    },
    {
      "name": "openai-agent",
      "count": 2
    },
    {
      "name": "ai-coding-chatbot",
      "count": 1
    },
    {
      "name": "cairn",
      "count": 1
    },
    {
      "name": "chatgpt",
      "count": 1
    },
    {
      "name": "claude-cowork",
      "count": 1
    },
    {
      "name": "claude-desktop",
      "count": 1
    },
    {
      "name": "copilot-cli",
      "count": 1
    },
    {
      "name": "hermes",
      "count": 1
    },
    {
      "name": "irregular-gemini-evaluation",
      "count": 1
    },
    {
      "name": "metr-agent-dashboard",
      "count": 1
    },
    {
      "name": "openai-agent-swarm",
      "count": 1
    },
    {
      "name": "openai-web-research-agent",
      "count": 1
    },
    {
      "name": "openclaw",
      "count": 1
    },
    {
      "name": "replit-agent",
      "count": 1
    },
    {
      "name": "strix",
      "count": 1
    },
    {
      "name": "unnamed-ai-agent",
      "count": 1
    },
    {
      "name": "unnamed-coding-assistant",
      "count": 1
    },
    {
      "name": "vscode-copilot-chat",
      "count": 1
    }
  ],
  "byHarm": [
    {
      "name": "data-exfiltration",
      "count": 13
    },
    {
      "name": "data-loss",
      "count": 13
    },
    {
      "name": "harmful-action",
      "count": 10
    },
    {
      "name": "credential-theft",
      "count": 8
    },
    {
      "name": "intrusion",
      "count": 7
    },
    {
      "name": "arbitrary-command",
      "count": 5
    },
    {
      "name": "file-read",
      "count": 1
    }
  ],
  "byDivergence": [
    {
      "name": "instruction-followed",
      "count": 16
    },
    {
      "name": "decomposed-misuse",
      "count": 12
    },
    {
      "name": "scope-exceeded",
      "count": 12
    },
    {
      "name": "shortcut",
      "count": 9
    },
    {
      "name": "goal-hijacked",
      "count": 6
    },
    {
      "name": "deception",
      "count": 1
    },
    {
      "name": "instruction-lost",
      "count": 1
    }
  ],
  "byApproval": [
    {
      "name": "auto-approve",
      "count": 31
    },
    {
      "name": "no-prompt-by-design",
      "count": 11
    },
    {
      "name": "allowlisted-tool",
      "count": 5
    },
    {
      "name": "unknown",
      "count": 4
    },
    {
      "name": "always-allow",
      "count": 2
    },
    {
      "name": "sandbox-escape",
      "count": 2
    },
    {
      "name": "credential-in-config",
      "count": 1
    },
    {
      "name": "none-required",
      "count": 1
    }
  ],
  "byRecovery": [
    {
      "name": "not recorded",
      "count": 23
    },
    {
      "name": "unknown",
      "count": 6
    },
    {
      "name": "recovered",
      "count": 4
    },
    {
      "name": "partially-recovered",
      "count": 2
    },
    {
      "name": "unrecovered",
      "count": 1
    }
  ],
  "byStatus": [
    {
      "name": "candidate",
      "count": 57
    }
  ],
  "fixOwners": {
    "operator": 56,
    "harness-vendor": 36,
    "model-provider": 29,
    "infra-provider": 8,
    "package-registry": 3,
    "tool-provider": 3
  },
  "topControls": [
    {
      "type": "reconfigure",
      "target": "agent.approval",
      "count": 35,
      "ids": [
        "ACVE-2026-0201",
        "ACVE-2026-0203",
        "ACVE-2026-0214",
        "ACVE-2026-0215",
        "ACVE-2026-0216",
        "ACVE-2026-0218",
        "ACVE-2026-0501",
        "ACVE-2026-0502",
        "ACVE-2026-0503",
        "ACVE-2026-0506",
        "ACVE-2026-0508",
        "ACVE-2026-0509",
        "ACVE-2026-0513",
        "ACVE-2026-0518",
        "ACVE-2026-0520",
        "ACVE-2026-0522",
        "ACVE-2026-0523",
        "ACVE-2026-0526",
        "ACVE-2026-0534",
        "ACVE-2026-0535",
        "ACVE-2026-0536",
        "ACVE-2026-0537",
        "ACVE-2026-0539",
        "ACVE-2026-0540",
        "ACVE-2026-0541",
        "ACVE-2026-0542",
        "ACVE-2026-0543",
        "ACVE-2026-0544",
        "ACVE-2026-0545",
        "ACVE-2026-0546",
        "ACVE-2026-0547",
        "ACVE-2026-0549",
        "ACVE-2026-0552",
        "ACVE-2026-0553",
        "ACVE-2026-0554"
      ]
    },
    {
      "type": "reconfigure",
      "target": "anthropic.safeguards",
      "count": 6,
      "ids": [
        "ACVE-2026-0525",
        "ACVE-2026-0528",
        "ACVE-2026-0529",
        "ACVE-2026-0530",
        "ACVE-2026-0531",
        "ACVE-2026-0532"
      ]
    },
    {
      "type": "reconfigure",
      "target": "anthropic.claude-code.permissions",
      "count": 3,
      "ids": [
        "ACVE-2026-0215",
        "ACVE-2026-0509",
        "ACVE-2026-0549"
      ]
    },
    {
      "type": "reconfigure",
      "target": "anthropic.evaluations.cyberSafeguards",
      "count": 3,
      "ids": [
        "ACVE-2026-0534",
        "ACVE-2026-0535",
        "ACVE-2026-0536"
      ]
    },
    {
      "type": "reconfigure",
      "target": "ctf-harness.network",
      "count": 3,
      "ids": [
        "ACVE-2026-0534",
        "ACVE-2026-0535",
        "ACVE-2026-0536"
      ]
    },
    {
      "type": "upgrade",
      "target": "harness:cursor",
      "count": 3,
      "ids": [
        "ACVE-2025-0009",
        "ACVE-2026-0005",
        "ACVE-2026-0006"
      ]
    },
    {
      "type": "reconfigure",
      "target": "openai.training.network",
      "count": 3,
      "ids": [
        "ACVE-2026-0526",
        "ACVE-2026-0543",
        "ACVE-2026-0545"
      ]
    },
    {
      "type": "reconfigure",
      "target": "cursor.agent.sandbox",
      "count": 2,
      "ids": [
        "ACVE-2026-0005",
        "ACVE-2026-0006"
      ]
    },
    {
      "type": "reconfigure",
      "target": "google.gemini-cli.shell",
      "count": 2,
      "ids": [
        "ACVE-2026-0502",
        "ACVE-2026-0503"
      ]
    },
    {
      "type": "upgrade",
      "target": "harness:claude-code",
      "count": 2,
      "ids": [
        "ACVE-2025-0004",
        "ACVE-2025-0005"
      ]
    }
  ]
}