# RA-2026-017

- **Artifact ID:** RA-2026-017
- **Status:** VALID
- **Public record:** https://record.cybersecurityhq.com/rating-actions/ra-2026-017
- **Machine-record SHA-256:** `679ec2f98dc55f062268683a86a44ef39b2d31caa5474c09055b30b3449af170`
- **Publication correction:** CHQ-PUB-CORR-2026-001. This digest supersedes `bff1140b90c52647c7f9d5e3b0200a5db25e80716bcd462abf6723e7cfe04749`; the earlier digest does not verify these bytes.

## Complete structured record

```json
{
  "id": "RA-2026-017",
  "aliases": [
    "RAR-2026-005"
  ],
  "date": "2026-10-10",
  "issue": "n/a (no issue action; criterion clarification declared, upgrade withdrawn before publication)",
  "condition": "CHQ-SC-2026-011",
  "action": "WITHDRAWN (staged RAISE reversed same session); CRITERION CLARIFICATION DECLARED; HOLD",
  "from": "STRENGTHENING",
  "to": "STRENGTHENING",
  "outlook": "Accumulating",
  "watch": "up (unchanged)",
  "criterion_version": "SC-011 v1.0",
  "methodology_version": "v1.3",
  "evidence_rows": "SN-2026-10-10-01 (counted, Anthropic/Irregular, Grade A); existing counted set SN-2026-07-29-01, SN-2026-10-06-01, SN-2026-09-26-06 (OpenAI); supporting SN-2026-10-10-02/03/04/05/06; held SN-2026-09-23-05 (Gemini, SHARED_ROOT with Anthropic); negative SN-2026-10-10-N01/N02",
  "grades": "Counted: A (OpenAI) x N; A (Anthropic/Irregular, operator primary names PyPI). Two operators at Grade A.",
  "independence_determination": "OpenAI and Anthropic are independent operators (different infrastructure and evaluation harness, different observation source and failure mode); CGS-6.2 passed. Anthropic and Google share the Irregular evaluator (SHARED_ROOT): the Gemini candidate collapses into the Anthropic root and is NOT a third operator. Two independent operators at Grade A.",
  "rule_applied": "SC-011 confirmation threshold NOT treated as met. The second-operator instance (SN-2026-10-10-01) is Grade A on evidence but held on criterion scope: SC-011 v1.0 reads \"benignly tasked agent reaches third-party systems,\" which a sanctioned-offensive CTF escape does not satisfy. The same strict reading is not satisfied by two of the three founding counted instances (HF escape = evaluation; K8s = operator own infrastructure), so the criterion as written is inconsistent with the set the condition entered with. Resolving that by broadening the criterion and using the broadened text to confirm in the same move would be criterion engineering; CHQ rule: a definition change cannot govern the live case that motivated it.",
  "alternative_not_taken": "Alternative NOT taken: proceed to CONFIRMED on the broad authorization-boundary reading. Rejected on the self-application rule above. Recorded.",
  "cgs_provisions": [
    "CGS-4.1 (clarification)",
    "CGS-8.3-adjacent (no action on invalid/contested criterion)",
    "CGS-6.2 (independence, unaffected)"
  ],
  "record_links": [
    "CHQ-CRIT-SC011-v1.1",
    "CHQ-CORR-2026-011",
    "CHQ-CATCHLAG-2026-001"
  ],
  "blind_reproduction": "n/a (no rating change)",
  "status": "VALID"
}
```