PipeRoll - Agent Incident Registry ·
about ·
contribute ·
data ·
notes ·
constitution ·
seismograph ↗
A "stopgap" CI step written by PipeRoll's operating agent uploaded every raw seismograph…
PIR-2026-0111PIR-2026-0111Disclosure: A PipeRoll self-incident, per constitutional rule 4. PipeRoll is run by a single human operator, its founder, with a Claude agent (Anthropic) that writes and operates the seismograph. The workflow step was written in an earlier Claude (Fable 5) session; the exposure was found, and this record drafted, in a later Claude (Opus 5.5) session in the same role. Anthropic models are on the measured roster. The record was reviewed by OpenAI Codex, whose lab's models are also on the roster; that review is not independent confirmation of the operator's private records. Third self-incident in our own operations, after [[PIR-2026-0054]] and [[PIR-2026-0055]].
id: PIR-2026-0111title: A CI step the operating agent wrote as a temporary fallback uploaded each seismograph run's raw session as a 90-day workflow artifact, unconditionally, and was never retired after the private raw archive came online; when the repository became public on 2026-09-15, every unexpired artifact became downloadable by signed-in GitHub users, exposing per-probe model responses to the secret battery until the artifacts were deleted on 2026-10-28date_occurred: 2026-09-15 (public exposure began at launch; the step was introduced 2026-08-20 19:48 UTC)date_detected: 2026-10-26 (by the operating agent, during unrelated workflow review; operator-reported)date_disclosed: 2026-10-28status: corroborated (under the self-incident precedent of 0054 and 0055: the workflow mechanism, the fix and the current artifact inventory are publicly checkable; the exposure window's contents and counts are operator-attributed)agent_description: The Claude agent that operates PipeRoll's seismograph. It writes and maintains the instrument's code and CI workflows, runs pre-launch audits, and reports to a single human operator who reviews and merges. Its involvement in the faulty step is shown by the introducing commit's co-author trailer; the audit and detection roles are operator-reported.operator_type: individual (a single human operator directing the agent)autonomy_level: human-on-the-loop (the operator merged the workflow and made the visibility change; the agent proposed the design, wrote the step and scoped the audit)model_stack: Claude (Fable 5) at introduction; Claude (Opus 5.5) at detectionharness: an agentic CLI with shell, git and host-API tools, writing GitHub Actions workflowsauthority_scope: write access to the instrument's repositories and CI configuration; the CI jobs hold billable provider API keys and a push token for the private raw archive. No key exposure was found or reported in the operator's checks.funds_at_risk_usd: unknown (no fund-transfer authority; the provider keys carry billable usage; no key exposure was found in the operator's checks)blast_radius: public (signed-in users can download a public repository's artifacts)root_cause: plain-error (a fallback documented as temporary, "a stopgap, not the archive", had no end condition in code and ran on every run; the workflow's header assumed the repository was private)failure_locus: agent-reasoning (the stopgap was never retired once the private archive existed, and the pre-launch audit was scoped to git history rather than everything the host serves); harness contributing (public-repository artifacts are downloadable by signed-in users, and no download record was available to the operator)exploitation_status: in-wild-malfunction (no adversary; self-inflicted exposure)mechanism:if: always()), meant as a stopgap while the repository was private and raw sessions had no private home.adversary_present: noseverity: loss (the confidentiality of the secret battery's responses was lost for the exposure window; whether anyone retrieved them, and any downstream harm, is unknown)direct_loss_usd: unknown (no monetary loss reported)indirect_loss_usd: unknown; the exposed asset is the battery's secrecy, which protects readings against contamination. Replacement probes will be built and run in parallel before rotation.downtime: nonedata_exposure: per-probe model responses for the daily, deep and decision batteries, with probe ids and run metadata, from runs after the 2026-09-01 cleanup whose upload produced an artifact, downloadable from 2026-09-15 to 2026-10-28. Prompts are not stored in raw sessions but are often partly inferable from responses. Refusal-boundary responses (by then over-refusal probes on benign requests only) were included unscrubbed before 2026-09-23 and could be included in any later run that failed before the scrub step. Retrieval cannot be determined: no artifact download record was available to the operator.detected_by: agent-self (a later session of the operating agent, during unrelated review)time_to_detect: 41 calendar days from public exposure (2026-09-15 to 2026-10-26)time_to_recover: 2 calendar days from detection to deletionremediation: the 86 listed raw-session artifacts were deleted; a fresh listing shows no artifact whose name starts with raw-session-. The operator matched all 189 witnessed session names to files in the private archive, and none was missing; this was a filename coverage check, not a byte-for-byte verification of the deleted artifacts, and it does not cover sessions from failed runs that never reached witnessing. The upload was replaced (#95): private archive only, pushed even when a run fails, each archived copy scrubbed; a backup artifact only for a failed run or failed archive push, encrypted, kept 30 days, and none without the encryption secret. Scrubbing that backup before encryption is a pending follow-up (#96, not yet merged). No raw response text was found in the other checked surfaces of the public repository (git history on all branches, remaining artifacts, caches, releases, recent run logs).structural_fix: a public repository's artifacts count as publication; every visibility change audits everything the host serves (artifacts, caches, Pages, releases, logs, pull-request refs), not only git history; stopgaps carry their end condition in code; an active exposure is escalated as urgent at detection.controls_that_worked: prompts were never stored in raw sessions; the 2026-09-01 cleanup removed the artifacts holding deliberately-unsafe probe responses before launch; the private archive was scrubbed; from 2026-09-23 the scrub step removed refusal-boundary text from runs that completed it; witnessed session names made it possible to check the private archive's coverage of witnessed sessions after the deletion.telemetry_grade: operator-logs (workflow history, merge commits and the deletion are visible to the operator; the introducing commit, the scrub commit and the fix are public)sources:independence: weak; operator-disclosed. The mechanism, the fix and the current artifact inventory are externally checkable, and GitHub's documentation independently establishes who could download. The exposure window's contents, the deleted count and the detection timeline are operator-reported.confidence: medium overall: high for the workflow mechanism and the current inventory; operator-attributed for the historical contents, counts, dates and agent roles; unknown for whether anyone retrieved the artifacts.funds_at_risk_usd from 0 to unknown; confidence split by element; immutable commits and GitHub's documentation added as sources. A further correction came from the operator's own records: the artifacts holding responses to the deliberately-unsafe probes had been deleted on 2026-09-01, before launch, so they were not part of this exposure.