A vendor telemetry or incident-response source (Mandiant/GTIG, Microsoft, Unit 42, Huntress, watchTowr, Sysdig, CrowdStrike, Sophos) publishes, after issuance, an account of an attacker-operated AI agent framework used in a real intrusion that includes recovered agent artifacts (instruction, configuration or prompt files) and a described victim, for an actor other than JadePuffer/Storm-3168, on or before 2027-01-11.
OPEN · EXPERIMENTAL
- id
- SO-2026-006
- class
- EVIDENCE_PUBLICATION
- claim
- A vendor telemetry or incident-response source (Mandiant/GTIG, Microsoft, Unit 42, Huntress, watchTowr, Sysdig, CrowdStrike, Sophos) publishes, after issuance, an account of an attacker-operated AI agent framework used in a real intrusion that includes recovered agent artifacts (instruction, configuration or prompt files) and a described victim, for an actor other than JadePuffer/Storm-3168, on or before 2027-01-11.
- issued
- 2026-10-13T12:30:00Z
- probability
- 0.5
- benchmark
- 0.4
- benchmark kind
- ANALYST_PRIOR
- benchmark basis
- Registry base: attacker-agent accounts Jul (Sysdig), Sep (GTIG, with artifacts), Sep (Microsoft, no artifacts): roughly one per six weeks, one in three with artifacts. The GTIG 8 Sep report pre-dates issuance and does not count.
- adjustment
- 0.1
- resolution rule
- YES if such a publication dated after issuance meets all four elements (agent framework, real intrusion, recovered artifacts, actor not JadePuffer).
- admissibility
- Only publications dated after 2026-10-13T12:30Z count; for EVENT-class, only events occurring after that timestamp count. Evidence pre-dating issuance resolves the forecast RETROSPECTIVE_DISCOVERY, not YES.
- exclusions
- Not recorded
- resolves
- 2027-01-11
- status
- OPEN
- outcome date
- Not recorded
- outcome basis
- Not recorded
- brier
- Not recorded
- benchmark brier
- Not recorded
- resolution source
- EXTERNAL
- experimental
- true
- false positive cost
- Over-forecast would overstate how often vendors recover and publish agent artifacts.
- ledger hash
- 4390d1c0c82719f2
- revision log
- record links