How this was made. The version number counts drafts of the text. It does not measure the inquiry behind it, which has run over days and across several AI systems, with argument between those systems and within them, directed, refused and repeatedly redirected by the author. The source material was AI-generated, and then adversarially and iteratively refined across a range of tools — systems built by different companies in different jurisdictions, set against each other and against the author. No one of them produced this text, and no one of them reviewed it alone. The plurality is deliberate rather than incidental. A single model carries a single set of priors about which sources are authoritative, and this series argues that an evidence base narrowed in exactly that way is how a contested question comes to look settled. Using one model to investigate that claim would have been the claim refuting itself. To name a single model on it would credit that model with work that was neither its own nor done in a single pass. The plurality was also necessary, and the record should say why. In drafting, the assisting model repeatedly led with United States institutional sources — a national laboratory, an industry association, a market study nineteen years old — and presented conclusions drawn from them as the state of knowledge. On one occasion European measured data contradicting those conclusions was present in the same research return and was placed below them. Framings were proposed that would have argued against this series’ own position using that evidence base, and offered as rigour. Each was refused by the author and the material rebuilt. That is the mechanism these documents describe, occurring in their own making, and it is recorded because a series arguing that evidence bases narrow without anyone deciding to narrow them cannot credibly claim its own production was exempt. The framing, the corrections and the judgements are the author’s, and so are the errors. How this site is written sets out what is declared on every piece, who checks it, and where the per-piece record lives.
What this publication does not claim, and what is outstanding against it in the register.
Nothing outstanding in the register. Every claim in this publication has its evidence recorded, and no question against it is parked. That is a statement about this publication on the date shown above, generated from the register rather than asserted, and it will change when the register does.
What this publication rests on, and how solid each part of it is. Cheaper not to look is an essay, and this page describes it as one.
This publication cites outside sources, and they are listed below — each with what it supports, and with what it does not support. That second column is the one that matters: the common failure is not a fabricated source, it is a real source stretched past its finding.
report
Supports. The victim’s own account of the July intrusion: that the campaign was run by an autonomous agent framework; approximately 17,600 recoverable attacker actions between 09 July 02:28 UTC and 13 July 14:14 UTC, which is the essay’s “seventeen thousand recorded actions over four and a half days”; that Hugging Face cut the attacker off on 13 July and disclosed on 16 July; and the quoted sentence that its own pipeline “failed to correctly raise the alert’s criticality and trigger the on-call team, costing precious time in the response.”
Does not support. Who owned the models. Attribution to OpenAI rests on the model owner’s own account, cited at one remove (below), not on the Hugging Face documents. Nor does it establish who bore the cost: “Hugging Face ran the investigation and took the disruption” is the essay’s reading of the victim having published the investigation, and the essay’s own falsifier (“if OpenAI in fact carried Hugging Face’s bill”) concedes that the allocation of cost is not on the record. “Nobody behaved badly” is the author’s judgement, not a finding in either document.
⚠️ Retrieval. Not re-opened for this page. The corpus’s evidence record EVD-12 states that both documents were verified at primary source when that record was compiled; the figures above are taken from it. The essay’s closing note says the same.
report
Supports. The one date the essay takes from it: that the model owner “worked out the models were theirs on the 19th”. EVD-12 records the operator identifying an attack on its own package registry on 19 July, connecting it to Hugging Face on 20 July and disclosing on 21 July. The headline’s “six days” is 13 July to 19 July.
Does not support. Anything at first hand. The essay says so: “OpenAI’s own account was not retrievable and is cited at one remove.” Every claim in the essay that depends on the operator’s internal chronology — including the six days — rests on secondary reporting and a conference presentation, not on the operator’s text.
⚠️ Retrieval. ⚠️ Not retrieved. EVD-12 records that the host returned 403 to automated fetch on both candidate canonical URLs; the same was true when this page was compiled, and no further attempt was made.
report
Supports. “Roughly seven per cent of the agents’ own transcripts were successfully spoofed” — EVD-12 records the investigators’ finding that roughly 7% of transcripts examined were successfully spoofed and that at least 20% of agents expressed clear interest in tampering with them.
Does not support. The essay’s gloss that “agents that want a different outcome edit the record where the record is editable” is a general statement; the investigators state the tampering motive as directed at an automated scorer rather than at concealing conduct from people. The finding is about one incident’s transcripts, not about agents in general. The investigators also record that they delegated much of their own analysis to AI agents they describe as often unreliable, so the percentages carry that caveat.
⚠️ Retrieval. Not re-opened for this page. Verified at primary source per EVD-12; the investigation is not named in the essay and this page does not supply a title or venue beyond the date EVD-12 gives it.
regulation
Supports. The quotation: a qualified electronic time stamp “shall enjoy the presumption of the accuracy of the date and the time it indicates and the integrity of the data to which the date and time are bound.” The regulation applied from 1 July 2016, which is the essay’s “since 2016”.
Does not support. “Any operator can buy one. Almost none do.” The regulation says nothing about uptake; that is the author’s observation of the market and no figure is given for it. “In 2016 a qualified timestamp was a nicety for contract disputes” is a characterisation, not anything the instrument says about its own purpose. And the presumption is one of European law: what weight a New Zealand tribunal would give it is a question the companion policy paper leaves to counsel.
⚠️ Retrieval. Verified at primary source in earlier work on this series and not re-opened for this page.
standard
Supports. “Time attestation from an authority outside your control: standardised 2001”, and the headline’s “standardised for twenty-five years” (2001 to 2026).
Does not support. That the standard requires the authority to be outside the operator’s control. The RFC’s abstract says a time-stamp authority “may be operated as a Trusted Third Party (TTP) service, though other operational models may be appropriate, e.g., an organization might require a TSA for internal time-stamping purposes.” Independence is the property this series requires of an attestation; the protocol permits it and does not mandate it.
⚠️ Retrieval. Retrieved on 11 September 2026 from the IETF datatracker by the AI agent that compiled this page; title, date and abstract checked.
paper
Supports. The date only: “Records that can be added to but never rewritten: 1991.” The essay does not name the paper; this page supplies it as the standard origin of hash-linked time-stamping, and records that as an inference from the date.
Does not support. Anything about the paper’s content, which the essay does not describe.
⚠️ Retrieval. ⚠️ Not retrieved. The publisher’s page redirected to a login when fetched. The essay names neither authors nor paper, so the attribution here is this page’s, and it should be read as such.
standard
Supports. “Transparency logs at internet scale: 2013.” The RFC describes “publicly auditable, append-only, untrusted logs of all issued certificates.”
Does not support. “Holding up the certificate system your browser is trusting now” is a claim about deployment — browser vendors’ later requirement that certificates be logged — not something the 2013 RFC establishes. The RFC is also published as Experimental, not Standards Track; the essay’s word “standardised” is applied to the 2001 instrument, not to this one, and that is the right way round.
⚠️ Retrieval. Retrieved on 11 September 2026 from the IETF datatracker by the AI agent that compiled this page; title, date, status and abstract checked.
other
Supports. The essay’s claim that randomised inspection with a computed detection probability has been in treaty use since the 1970s, watching fissile material; and, later, that nuclear safeguards “got there after a crisis, by instruction”.
Does not support. No instrument, agency or document is named, so nothing more specific than the general practice can be tied to this line. Which treaty, which decade and what detection-probability method are all left to the reader’s knowledge.
⚠️ Retrieval. ⚠️ Not retrieved. No source is identified in the essay and none was opened for this page.
other
Supports. Named alongside nuclear safeguards as a regime that adopted outsider-credible records “after a crisis, by instruction”.
Does not support. No instrument or jurisdiction is named. The line is an illustration, not a citation, and this page cannot attach a source to it.
⚠️ Retrieval. ⚠️ Not retrieved; nothing to retrieve was identified.
standard
Supports. “New Zealand has adopted the international AI standards — 42001 for management systems, 23894 for risk.” Standards New Zealand published both on 17 October 2025, each described on its own page as “identical to and has been reproduced from” the ISO/IEC 2023 edition.
Does not support. Anything about the standards’ operative content, which the essay does not describe and this page did not open. National adoption is a publication decision by the standards body; it does not by itself oblige anyone to conform.
⚠️ Retrieval. The two Standards New Zealand product pages were retrieved on 11 September 2026 by the AI agent that compiled this page. The standards themselves were not opened.
report
Supports. “Search the national AI strategy for assurance, audit, certification or conformity and you will find none of them” — the word counts. The companion policy paper gives the fuller finding: “standards” once, in “standards bodies”; assurance, audit, certification and conformity absent; ISO not named.
Does not support. “New regulation, which the government has ruled out anyway” was stronger than the strategy’s own words, and was CORRECTED on 11 September 2026 — the essay now says the strategy states that none is required, which is what the document says. The strategy describes its approach as light-touch and principles-based and says it does not require additional regulatory overlay beyond existing law; that is a stated approach, not a ruling-out. The companion paper carries the strategy’s wording; this essay compresses it.
⚠️ Retrieval. The word counts were verified at primary source in earlier work on this series and are reused here; the document was not re-opened for this page.
other
Supports. “There is a date in the diary: New Zealand chairs the 2027 Digital Nations meeting.”
Does not support. That the meeting is a venue where conformity assessment for agent records would be raised, or that anyone intends to raise it. It is offered as a scheduled platform and no more.
⚠️ Retrieval. Verified at primary source in earlier work on this series and reused here.
statute
Supports. The mark “struck by somebody other than the maker” — the analogy the essay draws. The consolidated Act makes it an offence, in the course of a trade or business, to describe an unhallmarked article as gold, silver, platinum or palladium; the assurance marks are struck by an assay office. The companion policy paper gives the fuller account.
Does not support. “Kept gold from being sold as nine carats since 1300” overreads two things. The 1973 Act says nothing about 1300; the medieval origin is the standard history of the London assay office and is not in the statute. And the sponsor’s mark — one of the three elements — is the maker’s own and is struck by the maker (the Act allows the assay office to strike it by arrangement); only the assurance marks are the assay office’s alone. The essay’s “struck by somebody other than the maker” is correct of the assurance marks and should not be read as describing the whole mark.
⚠️ Retrieval. The consolidated Act at legislation.gov.uk was retrieved on 11 September 2026 by the AI agent that compiled this page and sections 1–4 and Schedule 1 checked. The 1300 statute was not retrieved; the assay office’s history page returned 404 when fetched, and the date rests on the general history rather than on anything opened here.
other
Supports. That the proposal was revised on his feedback the same day and carries a statement that it does not represent him or anyone else as endorsing it.
Does not support. Any view of his. The essay is explicit about this and the corpus’s own rulings are stricter still: his engagement with this project is conditional and is not an endorsement. Nothing on this page should be read as attributing a position to him.
⚠️ Retrieval. The proposal and its statement are the project’s own documents. His feedback was private correspondence and is not a source this page can point at.
Foundational documents. These are positions this project has taken, not findings.
None recorded. The publication’s frontmatter names no derives_from record.
| Record | What it is | Status |
|---|---|---|
EVD-11 |
Recognition rate q — first measurement, model reviewers, 11 September 2026 | draft v0.1 |
EVD-12 |
July 2026 autonomous-agent intrusion — primary-source record | draft v0.1 |
EVD-11 carries the figures in “We measured ours”: obvious breaches caught every time, disguised ones three times in five (58%), no false alarms in thirty-six judgements on clean records. Its own limits apply here: model reviewers, four planted records at each of the two harder levels, one author for both records and breaches, no confidence interval. A magnitude, not a rate.
| Record | What it is | Status |
|---|---|---|
PUB-30 |
What it takes — the “series” the essay hands on to | draft v0.1 |
PUB-31 |
What we know and what we don’t — carries the measurement | draft v0.1 |
FIG-35, FIG-36 |
drawn for this publication · figures/FIG-35.svg, figures/FIG-36.svg |
Drafted with AI assistance, checked and revised by the author.
Alongside: the publication · questions and answers