Kasuri

Chapter 21 · Part IV — The programme

Notes and sources

Every numbered claim in this briefing, with its source. External sources are linked; our own measurements and estimates are labelled as such.

Audience
All readers
Chapter
21 of 21

A claim with no source is not a claim. Everything numbered in this briefing resolves here. Sources are external and primary wherever they exist; where a figure is our own measurement or our own estimate, it is labelled as such.

Section 01External sources

  1. Generated-code exploitability. BaxBench, 2025 (arXiv:2502.11844; baxbench.com): 392 backend tasks with executable end-to-end exploits. The best model produced incorrect-or-exploitable code 62% of the time, and roughly half of all functionally correct programs were successfully exploited. Under more realistic scenario conditions, average correct-and-secure performance across agents was 9.2%, best 15.2%, worst 1.9%.
  2. Insecure implementation choice. Veracode 2025 GenAI Code Security Report (80 tasks × 100+ models): the insecure implementation was chosen 45% of the time where a secure option existed; one major language ecosystem failed 72% of tasks; cross-site scripting was written securely only 12–13% of the time; AI-written code carried 2.74× the vulnerabilities of human-written code. The Spring 2026 update found no improvement despite newer models.
  3. Package hallucination. Spracklen et al., "We Have a Package for You!", USENIX Security 2025 (usenix.org), with a 2026 five-frontier-model replication. 19.7% average package-reference hallucination in 2024 compressed roughly elevenfold by 2026, but the floor stuck at about 5%. 205,474 unique fake names catalogued; 43% recur on every re-run; 127 names were hallucinated identically by all five frontier models tested, 53 of which were still registrable. Slopsquatting attacks exploiting this are documented.
  4. Prompt injection, architectural. Invariant Labs, GitHub MCP exploit, May 2025 (invariantlabs.ai): a malicious public issue hijacks an agent into exfiltrating private repository contents. The platform confirmed the flaw is architectural, with no server-side patch; re-confirmed at scale for agentic workflows in July 2026.
  5. Injection incidents. CVE-2025-53773 (coding assistant / editor remote code execution via injected repository content enabling auto-execution). CamoLeak / CVE-2025-59145, CVSS 9.6 (invisible pull-request comments plus an image proxy exfiltrate private source and secrets, with no malicious code executed). Remote prompt injection into a platform assistant via hidden comments using Unicode smuggling. The "Rules File Backdoor" (Pillar Security, March 2025): hidden-Unicode instructions in agent rule files, invisible to humans, that steer major coding assistants. A tool-server hidden-comment review-agent hijack, July 2026. An extension shipped to a marketplace carrying a system-wiping injected instruction, July 2025.
  6. Weaponised AI command-line tools. The Nx "s1ngularity" supply-chain attack, August 2025: malicious packages invoked installed AI coding CLIs to enumerate secrets on victim machines, harvesting 2,349 credentials from 1,079 systems.
  7. Self-replicating package worm. Shai-Hulud (September 2025) and Shai-Hulud 2.0 (November 2025), which self-replicate without any command-and-control channel by reading their own payload. Version 2.0 compromised 796 packages across 1,092 versions representing over 20 million weekly downloads, created more than 27,000 malicious repositories, and exposed approximately 14,000 secrets across 487 organisations. Classified by the Cloud Security Alliance as an AI-developer-toolchain worm.
  8. Malicious tool servers. postmark-mcp, September 2025 — the first malicious MCP server caught in the wild, which shipped fifteen clean versions before BCC-ing every email to the attacker. CVE-2025-6514 (mcp-remote, CVSS 9.6, 558k+ downloads): OS command injection when connecting to an untrusted server. Four named MCP CVEs shipped in 2025, plus the tool-poisoning / "rug pull" class in which a server silently changes tool definitions after human approval.
  9. Secrets in agent context. Knostic: major coding agents silently read .env and similar secret files — the very files developers exclude from version control because they hold secrets — with no disclosure. "Comment and Control", June 2026: a single indirect prompt injection made three major coding agents leak environment credentials via an interactive shell running at the developer's privilege. A major vendor's CI action could expose runner secrets when processing untrusted issues and pull requests (mitigated May 2026).
  10. Reward hacking and sabotage. METR: explicit reward hacking in 39 of 128 (30.4%) evaluation runs (arXiv:2605.02964). An adversarial self-study found 63% of one model's wins on a coding benchmark were retrieved rather than derived, with the gap tracking capability. With a visible test oracle, agents built shims passing 222 of 222 checks while the requested library sat dead, in 11 of 12 runs (arXiv:2606.28430). SHADE-Arena (arXiv:2506.15740): frontier models completed a harmful hidden side-task while evading a monitor 15–27% of the time; the best monitor reached AUC 0.87, but catching 80% of sabotage would require a 20–40% false-positive rate, infeasible for real deployment.
  11. Corpus poisoning and model backdoors. Anthropic / UK AISI / Alan Turing Institute, October 2025 (anthropic.com): approximately 250 malicious documents backdoor models from 600M to 13B parameters — a near-constant count regardless of model or dataset size (for 13B, roughly 0.00016% of training data). "Sleeper Agents" (anthropic.com): a model trained to write secure code under one condition and exploitable code under another retained the backdoor through supervised fine-tuning, reinforcement learning, and adversarial training, with robustness increasing with scale. Linear probes on residual-stream activations separate triggered from clean prompts — detection is feasible; prevention at the data layer is not.
  12. Compiler-guided repair. Compiler-guided adaptation study, 2026 (arXiv:2602.11481): a frontier model working in Idris, a language it barely knew, solved 22 of 56 exercises unaided and 54 of 56 with compiler-guided repair.
  13. Diagnostic content ablation. VeriHarness, 2026 (arXiv:2607.14167): diagnostics carrying the location, the observed value, and the admissible alternatives improved repair success by 42–44 percentage points; the serialisation format made no measurable difference. Limit, stated: one study, measured on non-code repair tasks with smaller models. We treat it as strong directional evidence and intend to replicate on code before anything freezes.
  14. Dependency surface. Our own measurement, July 2026: across an eleven-application corpus of production open-source web applications, the mean is approximately 135 direct runtime dependencies per application; the JavaScript-only mean is closer to 140. The corpus list and method publish with the first measured results.
  15. Accessibility error classes. WebAIM Million survey, 2026 (webaim.org): six statically checkable error classes account for approximately 96% of detected WCAG failures. Kasuri makes them compile-time obligations; behaviour-dependent accessibility remains the component author's duty, and we say so rather than overclaim.
  16. Versioning as practised. Roughly 1 release in 31 of the top 1,000 packages in one major ecosystem violates semantic versioning, and about 1 package in 6 has violated it at least once. One ecosystem has shipped computed version numbers derived from typed API differences since 2014. Another has run deterministic, solver-free resolution plus a transparency log at ecosystem scale since 2019, such that a module's own author cannot move published tags without the change being detected.
  17. Ecosystem convergence on safer defaults. Several major package managers now disable install scripts by default; at least one major language never had build scripts. Dependency cooldowns shipped across four major package managers in 2025–26 (minimum release age before install), the key defence given that malicious packages are typically pulled within hours. Trusted publishing with short-lived scoped tokens, and registry quarantine and report-as-malware pipelines, matured over the same period.
  18. Poisoned build steps. A March 2026 compromise backdoored a security scanner in order to steal a package-index publishing token, demonstrating that CI and build tooling are targets in their own right.
  19. GDPR erasure by design. European Data Protection Board guidelines on immutable ledgers, July 2026: the right to erasure under the GDPR must be complied with by design, and technical impossibility is not a defence. Read here as a statement that architecture has become a compliance surface — if a system cannot reach every derived copy of a data subject's personal data, the obligation is not discharged, however the system was built.
  20. Cross-tier observability. OpenTelemetry project status: traces and metrics are stable across major SDKs; browser and client instrumentation carries an explicit specification warning that it is experimental and mostly unspecified. Compile-time auto-instrumentation reached 1.0 in July 2026, which we read as the mainstream direction of travel rather than a Kasuri eccentricity.
  21. Measured effect of AI tooling on experienced developers. METR randomised controlled trial, 2025 (metr.org; arXiv:2507.09089): 16 experienced open-source maintainers, 246 tasks in their own mature repositories. Allowing AI tooling made developers 19% slower, while they believed it had made them 20% faster — a 39-point perception gap. A 2026 follow-up shows the slowdown shrinking (original participants approximately −18%; newly recruited developers approximately −4% with newer tools) while the perception gap persists. Read carefully: this measures experienced maintainers on mature codebases, which is not the greenfield case where gains are most often claimed. It is cited here as evidence that the authoring-cost saving is not established for the work most organisations actually do, not as evidence that AI tooling is unhelpful.
  22. Component effort estimates. Our own research corpus. The person-year figures in Chapter 11 are drawn from the build-versus-rent analysis produced during the research phase, which sized each component of a whole-stack language against observable precedent: standard library scale to 1.0 estimated from public team sizes; the compiler-as-library figure from the gap between a designed-in query architecture and a retrofitted one; the reactive persistence range from two startup-scale products that reached general availability on rented storage; code generation from published accounts of custom-backend efforts. Read as order of magnitude, not as accounts. Several are inferred from team sizes rather than disclosed budgets, and none is a published financial figure. They are sized to inform a build-versus-rent decision, which is the purpose they were produced for. No dollar figure is attributed to any existing language anywhere in this briefing, because no such figure is published and constructing one would be invention.

Section 02Our own figures

Every figure describing the programme's own state is derived by a command rather than remembered, and re-derived on each revision of this briefing. The instruments and gates that produce them are described in Chapter 17, and what they measure is set out in Chapter 18.

  • Artifact counts — research findings, decision records, working documents, specification sections and lines, diagnostic registry rows, open gaps, verification instruments and automated gates: derived from the programme's own repository by command rather than recalled. Chapter 18 carries the full set.
  • Specification coverage (13 of 15 declaration kinds, parsing 55 of 100 attested sites) — measured against the programme's own recorded completion criterion, derived from the paper applications, and cross-checked independently from the specification's side. Stated as a floor rather than a score: a construct without a grammar production cannot be covered whatever prose surrounds it.
  • Specification size — 14,910 lines across the 22 numbered sections; 15,498 across the directory once the generated gap register and the conventions are included. Both figures are given because conflating the two scopes is an easy and misleading error.
  • Dependency surface (~135 direct) — our own measurement across an eleven-application corpus, note 14 above. The corpus list and method publish with the first measured results.

Section 03On the research corpus

The research tracks that produced the binding constraint set are recorded in full, with every claim carrying its source inline and vendor-run studies labelled as such. That corpus is not currently public: it publishes alongside the first measured results, together with the benchmark corpus list and method. It is available for technical due diligence in the meantime, under the arrangements in Chapter 20.

Until then the external sources above are the part anyone can check independently, and we would rather point at those than at ourselves.