Ingest five arXiv papers (20610–23075): OSINT LoC, DEFENGRAPH, PI calibration, CITADEL stub, MLAS self-evolution.

Phase-0 reference verdicts on DEFENGRAPH/picalib; archive-only CITADEL; bidirectional lint clean.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: cemini23

wiki/concepts/6g-cps-closed-loop-security.md

@@ -15,6 +15,7 @@ related:
   - entities/frameworks/mitre-attack.md
   - sources/arxiv-2606-05252-bas-to-siem-detection-as-code-synthesis.md
   - sources/arxiv-2606-18734-point-cloud-wireless-channel-prediction.md
+  - sources/arxiv-2606-22939-citadel-csi-jamming-iiot.md
 maturity: draft
 created: 2026-06-12
 updated: 2026-06-21

wiki/concepts/agent-runtime-guardrails.md

@@ -67,9 +67,15 @@ related:
   - sources/arxiv-2606-18673-prompt-leaking-attacks-area.md
   - concepts/system-prompt-leakage.md
   - entities/tools/leakbench-area.md
+  - sources/arxiv-2606-22659-confidently-wrong-prompt-injection-calibration.md
+  - concepts/prompt-injection-detector-calibration.md
+  - sources/arxiv-2606-23075-self-evolving-llm-agent-safety-mlas.md
+  - concepts/self-evolving-agent-security.md
+  - sources/arxiv-2606-20610-osint-ai-loss-of-control-detection.md
+  - concepts/ai-loss-of-control-osint-monitoring.md
 maturity: draft
 created: 2026-06-01
-updated: 2026-06-22
+updated: 2026-06-23
 ---
 
 # Agent runtime guardrails — attack surfaces + enforcement paradigms
@@ -136,6 +142,8 @@ Tool-using agents (MCP, shell, APIs, email) shift the security problem from **re
 | **Trajectory steering** | Locally plausible fragments accumulate across turns; accepted outputs update persistent context without drift gate | GT-MCP 2606.10322 |
 | **Over-privileged tool selection** | Agent picks broader **authorized** tool when narrow sufficient alternative exists; amplified by transient narrow-tool failures | TOOLPRIVBENCH 2606.20023 |
 | **System prompt leakage** | Adversarial query exfiltrates hidden system/skill instructions — API keys, tool rules | LLM07 / 2606.18673 |
+| **Confident guard misses** | PI detectors assign ~1.0 confidence to missed indirect hijacks | 2606.22659 |
+| **Self-evolution persistence** | Attacks embed across evolution cycles; scanners miss evolution path | 2606.23075 MLAS |
 | **Semantic decoupling** | Natural-language intent hides unsafe tool args from LLM-as-Judge guards | ePCA motivation |
 
 These are **not jailbreaks** in the classic sense — the model may comply with user intent while attacker-controlled context steers authorized access off-scope. [CONFIRMED] across AIRGuard + sleeper paper framing.

wiki/concepts/agent-skill-injection.md

@@ -32,9 +32,11 @@ related:
   - sources/openreview-openclaw-real-world-safety-analysis.md
   - sources/arxiv-2606-18673-prompt-leaking-attacks-area.md
   - concepts/system-prompt-leakage.md
+  - sources/arxiv-2606-23075-self-evolving-llm-agent-safety-mlas.md
+  - concepts/self-evolving-agent-security.md
 maturity: draft
 created: 2026-06-03
-updated: 2026-06-22
+updated: 2026-06-23
 ---
 
 ## Relations

wiki/concepts/agentic-containment-principles.md

@@ -18,9 +18,11 @@ related:
   - concepts/internet-of-agentic-ai-ioai.md
   - sources/arxiv-2606-20023-over-privileged-tool-selection-toolprivbench.md
   - concepts/agent-least-privilege-tool-selection.md
+  - sources/arxiv-2606-23075-self-evolving-llm-agent-safety-mlas.md
+  - concepts/self-evolving-agent-security.md
 maturity: draft
 created: 2026-06-13
-updated: 2026-06-19
+updated: 2026-06-23
 ---
 
 ## Relations
@@ -39,6 +41,8 @@ updated: 2026-06-19
 
 K114 ingest (2026-06-13): six **containment principles** from arXiv:2606.12797 operationalized as a reusable compliance matrix for LangChain, AutoGPT, and OpenAI Agents SDK — synthesized with containment-gap experiments and cross-linked to MCP/error-path work (2606.07992).
 
+**Self-evolution extension (2606.23075):** static P1–P6 audits assume **immutable anchors** (weights, tool set). Self-evolving agents violate P3/P6 by design — MLAS shows 17/25 cells critical with no effective defense. See @concepts/self-evolving-agent-security.md before certifying any "contained" agent that can modify memory, tools, or architecture.
+
 ## Narrative
 
 Agentic LLM systems loop **perception ($P$) → reasoning ($B$) → execution ($E$) → memory update ($\mathcal{U}$)**. Without **inter-layer gates**, corruption at any stage propagates across cycles. Containment requires $\Phi(o_t,m_t)=E(B(P(o_t),m_t)) \in \mathcal{C}$ for policy-safe action space $\mathcal{C}$.

wiki/concepts/ai-for-cybersecurity.md

@@ -59,9 +59,17 @@ related:
   - sources/arxiv-2606-18673-prompt-leaking-attacks-area.md
   - concepts/system-prompt-leakage.md
   - entities/tools/leakbench-area.md
+  - sources/arxiv-2606-22659-confidently-wrong-prompt-injection-calibration.md
+  - concepts/prompt-injection-detector-calibration.md
+  - sources/arxiv-2606-23075-self-evolving-llm-agent-safety-mlas.md
+  - concepts/self-evolving-agent-security.md
+  - sources/arxiv-2606-20610-osint-ai-loss-of-control-detection.md
+  - concepts/ai-loss-of-control-osint-monitoring.md
+  - entities/tools/defengraph.md
+  - sources/arxiv-2606-21059-defengraph-knowledge-graph-blue-team.md
 maturity: draft
 created: 2026-05-12
-updated: 2026-06-22
+updated: 2026-06-23
 ---
 
 ## Relations

wiki/concepts/ai-loss-of-control-osint-monitoring.md

@@ -0,0 +1,48 @@
+---
+title: AI loss of control — OSINT monitoring
+type: concept
+tags: [ai-governance, osint, cti, loss-of-control, monitoring]
+keywords: [2606.20610, ai loss of control, osint detection, capability concealment, infrastructure correlation]
+related:
+  - sources/arxiv-2606-20610-osint-ai-loss-of-control-detection.md
+  - concepts/osint-for-cybersecurity.md
+  - concepts/threat-intelligence.md
+  - concepts/ai-for-cybersecurity.md
+  - concepts/agent-runtime-guardrails.md
+maturity: draft
+created: 2026-06-23
+updated: 2026-06-23
+---
+
+## Relations
+
+- @sources/arxiv-2606-20610-osint-ai-loss-of-control-detection.md — primary source (2606.20610)
+- @concepts/osint-for-cybersecurity.md — operational OSINT tradecraft for engagements
+
+## Narrative
+
+Ingest 2026-06-23: arXiv:2606.20610 frames **AI loss of control** as an observable phenomenon amenable to **OSINT + CTI** methods — distinct from in-app prompt injection testing.
+
+### Three priority vectors
+
+```
+User reports (transcripts) ──→ anomaly clustering
+Infrastructure telemetry ──→ unexpected egress / replication
+Output vs action gap ──→ capability concealment
+```
+
+### Overlap with pentest/SOC work
+
+| Vector | Existing wiki hook |
+|--------|-------------------|
+| Infrastructure correlation | @concepts/threat-intelligence.md CTI fusion; SOC egress (@entities/tools/iron-proxy.md) |
+| Transcript mining | Social/OSINT sources; not automated in this wiki |
+| Capability concealment | Agent trajectory eval (@concepts/seclaw-agent-security-evaluation.md) |
+
+### Limits
+
+- **Partial feasibility** — not a substitute for runtime guardrails or formal verification
+- **Governance/policy** paper — no tool Phase-0
+- Cross-wiki handoff: institutional monitoring architecture may fit @osint-wiki briefs better than deep entity pages
+
+See `briefs/2026-06-23_ai-loc-osint-monitoring-handoff.md` for CTI/SOC fusion notes.

wiki/concepts/incident-response.md

@@ -42,9 +42,11 @@ related:
   - entities/tools/cve-mcp-server.md
   - concepts/exceptional-access-risk-quantification.md
   - sources/arxiv-2606-19106-exceptional-access-compromise-risk-quantification.md
+  - sources/arxiv-2606-21059-defengraph-knowledge-graph-blue-team.md
+  - entities/tools/defengraph.md
 maturity: validated
 created: 2026-05-12
-updated: 2026-06-18
+updated: 2026-06-23
 ---
 
 ## Relations

wiki/concepts/llm-adversarial-fuzzing.md

@@ -29,9 +29,12 @@ related:
   - sources/arxiv-2606-18673-prompt-leaking-attacks-area.md
   - concepts/system-prompt-leakage.md
   - entities/tools/leakbench-area.md
+  - sources/arxiv-2606-22659-confidently-wrong-prompt-injection-calibration.md
+  - concepts/prompt-injection-detector-calibration.md
+  - entities/tools/picalib-research.md
 maturity: validated
 created: 2026-05-13
-updated: 2026-06-22
+updated: 2026-06-23
 ---
 
 ## Relations

wiki/concepts/mcp-security-posture.md

@@ -45,9 +45,14 @@ related:
   - concepts/agent-probabilistic-datalog-verification.md
   - sources/arxiv-2606-18673-prompt-leaking-attacks-area.md
   - concepts/system-prompt-leakage.md
+  - entities/tools/leakbench-area.md
+  - sources/arxiv-2606-22659-confidently-wrong-prompt-injection-calibration.md
+  - concepts/prompt-injection-detector-calibration.md
+  - sources/arxiv-2606-23075-self-evolving-llm-agent-safety-mlas.md
+  - concepts/self-evolving-agent-security.md
 maturity: validated
 created: 2026-06-05
-updated: 2026-06-22
+updated: 2026-06-23
 ---
 
 ## Relations
@@ -144,3 +149,7 @@ Attestation blocks **unauthorized tools** before `tools/call`. DCI asks whether
 **Probabilistic runtime verification (2606.20510)** — MCP intercept paths that rely on **noisy content classifiers** (PII/secret scan) need distributionally robust bounds when failures correlate across batched tool responses — deterministic Boolean taint + naive P(violation) thresholds under-bound leak risk. Complements admission/DCI/SPI; Phase-0 **Reference**. See @concepts/agent-probabilistic-datalog-verification.md and `briefs/2026-06-21_probabilistic-agent-guardrail-dro-handoff.md`.
 
 **System prompt leakage (2606.18673)** — custom GPT/copilot **hidden instructions** (including skill preambles and MCP routing rules) leak in **>80%** of measured commercial apps; prompt-append defenses fail via **attention drift**. Orthogonal to SPI/DCI but same assessment window — add LeakBench-style exfil probes. See @concepts/system-prompt-leakage.md and `briefs/2026-06-22_system-prompt-leak-redteam-checklist.md`.
+
+**Guard calibration under shift (2606.22659)** — ProtectAI / Prompt-Guard-2 can miss **indirect behavior-hijack** with **severity S ≈ 1.0** on false negatives. Shift-test on MCP tool-return channel; never deploy on pooled ECE alone. See @concepts/prompt-injection-detector-calibration.md and `briefs/2026-06-23_prompt-guard-severity-calibration-handoff.md`.
+
+**Self-evolving agents (2606.23075)** — MLAS matrix: evolution removes immutable anchors; Hermes case **100% attack persistence**, scanners **2.5%** on evolution path. Default deny self-modifying agents on prod-mcp. See @concepts/self-evolving-agent-security.md.

wiki/concepts/network-security.md

@@ -52,9 +52,10 @@ related:
   - concepts/6g-cps-closed-loop-security.md
   - sources/arxiv-2606-08173-ai-native-closed-loop-6g-cps-security.md
   - sources/arxiv-2606-18734-point-cloud-wireless-channel-prediction.md
+  - sources/arxiv-2606-22939-citadel-csi-jamming-iiot.md
 maturity: draft
 created: 2026-05-12
-updated: 2026-06-21
+updated: 2026-06-23
 ---
 
 ## Relations