Red team: October 2026 #1341

The monthly red-team pass (docs/specs/security-audit.md → "Red team"): an open-ended review of the code and the published guarantees, without the FAIL IF lines, on at least two model families. Findings go to the private ledger first; this issue records the pass once its findings are fixed or documented and disclosed.

Checklist

• Build one stripped tree per engine from main, and record the commit reviewed.
• Run each engine: Claude through Anthropic's Cyber Verification Program, Codex through OpenAI's Daybreak program (optionally Gemini).
• Run each engine's second round, which proves its claims against the real code.
• Verify every claimed break with a separate reviewer.
• File each confirmed item in the ledger, fix it in a plain-worded PR, and close it citing the PR.
• Record the pass in the private red-team/runs/.
• After the nightly audit discloses the fixed findings, summarize the pass here and close.

The most serious findings

Nothing found allowed an account takeover or remote access to a terminal. Every path to a terminal still required someone to type, at the laptop, the two digits a phone shows, plus a fresh passkey proof bound to that connection. Everything rated above low is described below. All of it is fixed in the release that follows this pass; every earlier release was affected.

Low-severity findings, fixed or documented: a malicious Relay holding a phone's stolen pairing key could obtain a presence proof (#1223, #1243); a signed-in session could displace a paired phone's push registration (#1226); approving an attacker's enrollment code left their passkey on your account until removed (#1244); allowing ::/0 under Local networks also allowed all IPv4 (#1240); a raised user-verification setting could be lost after a failed save and a restart (#1242); another Windows account could block VS Code's remote-control pipe (#1241, #1252); a Hosted production deploy did not itself verify pgstencil's signature (#1245); and several availability issues (#1225).

This month

Two passes, the first red-team passes Dormouse has run (#1194):

• Fixed: Derive the presence challenge in Pocket before prompting #1223, Hand the ICE agent only the candidates Local networks checked #1224, Judge a Hosted relay socket that never pings from its opening, and document three remote-control edges #1225, Harden Relay push registration and delivery #1226; Read no pairing frame while a confirmed pairing's write is in flight #1237, Register push only for the signed-in account's Burrows #1238, Retire a push tombstone only under the account that owns its row #1239, Check each address family only against its own allowed ranges #1240, Keep a raised user-verification demand across a Burrow restart #1242, Derive the sign-in challenge in Pocket before prompting #1243, List and remove Hosted Relay passkeys from the account page #1244, Check pgstencil's npm signature and provenance attestation before a Hosted production deploy #1245.
• Documented as not defended or a known gap: Judge a Hosted relay socket that never pings from its opening, and document three remote-control edges #1225, Record the Windows peer-link pipe squat as not defended #1241 (narrowed by Publish a fresh peer-link pipe name per bind on Windows #1252), Add "Sign out and forget this phone" to Pocket #1251.
• Disclosed: security-audit-finding.
• Process changes it led to: the second-opinion audit on Codex (Add Codex as an advisory red-team audit engine #1263, Separate the Codex advisory engine from the red team, and require session passkeys #1265, Run the second-opinion audit one work stream per Codex session #1273); the red team made monthly (Run the red team monthly #1336).

The nightly audit passed with no open findings at 44692b8 after these merged.