01Protecting the research process
MacBrains Labs studies Apple Silicon inference and maintains the software supporting that work. These project-owner advisories document two fixed defects in its private research automation tooling: unsafe archive destination construction and inconsistent validation of derivative research records.
Both arose in one June 2026 hardening effort. Later validation compared the vulnerable source, the repair commit and a pinned later revision in isolated copies. The work was operator-directed by Nayte Wilson and AI-assisted.
Archive containment and derivative-record validation, from one owner-operated hardening effort.
Pre-repair, repair and pinned later source compared through the existing program interfaces.
14 path checks and 45 record-validation checks passed on the pinned later source.
Recorded source-copy validation. The direct probes additionally compare six archive invocations and three derivative-record runs. Counts describe covered checks, not a general security certification.
02Project-owner advisories
- MBL
2026-001Archive path traversal
A proposal identifier escaped its archive. A direct comparison records the overwrite and the repaired containment behavior.
- MBL
2026-002Derivative-record validation
One authoritative write path omitted validation metadata. The repair applies the gate consistently, with remaining provenance limits.
MBL identifiers are local publication labels, not CVE identifiers. Repair record: 24 June 2026. First public publication: 31 October 2026 UTC.
Inspect the machine-readable observations, validation method and source availability, and public-file checksums. These records include benign controls, differences between vulnerable and repaired copies, and the limitations of each comparison.
These are owner-published reports. The source remains private, and the public summaries are not independent replication or a complete public reproducer. No CVE or external disclosure acceptance is claimed.
03Public research maintenance
Nayte Wilson also maintains ANE Research Records, a separate public repository of source-pinned measurement summaries and verification tools. Its security policy provides a private reporting contact.
The publication audit checks public release archives against the source tag and tests the handling of corrupted or inconsistent inputs. This verifies archive integrity; it does not independently reproduce private ANE measurements. The two advisories above concern different, private tooling.
Additional public engineering records
The following merged changes document defensive maintenance in Nayte Wilson's personal forks. Their source diffs and reported tests are public. They are supporting engineering records, separate from the two advisories and their 59-check validation total.
| Record | Documented change | Merged in fork |
|---|---|---|
| REA #5: package provenance | Checks repository identity, commit and package digest before treating an existing registry version as the fork's release. | 12 Oct 2026 |
| REA #1: snapshot ownership | Detaches caller-visible objects from retained evidence and active-target identity; includes regression witnesses for mutation boundaries. | 12 Oct 2026 |
| Hermes Conduit #10: control and query handling | Restricts presented control operations and encodes query values so reserved delimiters cannot introduce extra parameters. | 20 Sep 2026 |
REA is a fork of morluto/rea; Hermes Conduit is a fork of kaishi00/hermes-conduit. The merge records establish changes in these personal forks, not upstream acceptance or deployment to external users. PR-reported tests were not rerun for this publication. REA #1 retains a stale draft/unmerged note and reports remaining full-suite failures; its current GitHub metadata records the fork merge.
04Corrections and security reports
Send a suspected defect, exposed information or evidence inconsistency to research@macbrainslabs.org. Include the affected page or repository, revision if known, observed behavior and a minimal description. Keep credentials, personal data and sensitive reproduction details out of public issues.
The public contact is also available through security.txt. Publication does not grant permission to test third-party systems. Research scope and authorization are described in the methods statement.