# Correction: the first-seen date of attacker infrastructure was recorded as an exploitation date

- **Artifact ID:** CHQ-CORR-2026-035
- **Status:** IN FORCE
- **Public record:** https://record.cybersecurityhq.com/corrections/chq-corr-2026-035
- **Machine-record SHA-256:** `c690ec9bf49ea52c23a0c6c2118dff189c170c5b30e2936a5970708a328e4c4e`

## Complete structured record

```json
{
  "id": "CHQ-CORR-2026-035",
  "class": "CORRECTION",
  "subtype": "counting",
  "status": "IN FORCE",
  "authority": "DM ratified 2026-11-12",
  "effective": "2026-11-12",
  "published": "2026-11-12",
  "title": "Correction: the first-seen date of attacker infrastructure was recorded as an exploitation date",
  "what_was_wrong": "On SN-2026-11-09-01, a candidate on Autonomous AI Attack Operations, the exploitation date was recorded as 19 October 2026. In the source that is the date an attacker server was first seen. The source dates the campaign only to October 2026 and gives no exploitation date.",
  "what_is_true": "No exploitation date is established for the operation. The 19 October observation concerns infrastructure.",
  "what_changed": "The exploitation date is cleared and the observation is kept, labelled as infrastructure first seen. Corrected the day the row was written.",
  "what_did_not_change": "No count, rating, Outlook or Watch. The row is a held candidate and no interval was published from it.",
  "control_analysis": "Treating an infrastructure observation as exploitation manufactures a pre-disclosure interval. No mechanical control distinguishes the two; the distinction is recorded as a rule for the analyst.",
  "found_by": "An external review on the day of entry, verified against the source."
}
```