Reproduction design

Building a two-account action-provenance reproduction

When an AI agent can read shared content and write to connected applications, a convincing reproduction must show who controlled the input, whose authority powered the action, and where the resulting state persisted.

Keep the principals separate

Use two researcher-controlled accounts with stable roles. One account prepares and shares the untrusted artifact. The other owns the private source and destination state and invokes the connected assistant. Synthetic markers prevent real personal information from entering the experiment.

Capture the complete pre-state

Record ownership, sharing permissions, note bodies, unique markers, the absence of the expected mutation, and a visible clock. Avoid opening the attacker-controlled artifact from the victim account when the claim depends on no direct interaction with that artifact.

Record confirmation honestly

A confirmation dialog changes the authorization analysis. Capture its exact wording and the user action. A result that requires confirmation may still reveal instruction-hierarchy problems, but it should not be described as silent execution.

Prove persistence in the native product

After the agent finishes, record the mutated object, Activity metadata, version history, editor attribution, and state after refresh or a new session. Network traces are valuable corroboration, but native persistent state is the clearest evidence of the resulting action.