The bibliography
behind the scanner

The Papers

Seven studies,
and what they fed

1. Agentic-AI fault taxonomy — arXiv:2603.06847

385 coded faults from 13,602 issues across 40 agentic-AI repos, validated with 145 practitioners (Cronbach's α 0.91). Top root causes: Data Schema Mismatches at the LLM/tool output boundary (28.0%) and Model Interface Instability (11.6%) — together roughly 40% of sampled faults at one seam.

28.0% / 11.6% — Agentic-AI fault taxonomy, arXiv 2026, arxiv.org/abs/2603.06847

2. Open Agent Passport — arXiv:2603.20953

A deterministic policy gate held under adversarial pressure: in the paper's CTF, attacker success fell from 74.6% under a permissive policy to 0% under a restrictive one, across 879 attempts — even when the model itself had been socially engineered. Enforcement over prose, demonstrated adversarially.

74.6% → 0% over 879 attempts — Open Agent Passport CTF, arXiv 2026, arxiv.org/abs/2603.20953

3. HiL-Bench — arXiv:2604.09408

Frontier models drop 53–82 percentage points when task specs go from complete to missing/ambiguous/blocked — and the failure is usually not asking. Epistemic escalation ("I should ask") is a different protocol from authorization escalation ("may I run this"), and most harnesses document neither.

53–82 pp — HiL-Bench, arXiv 2026, arxiv.org/abs/2604.09408

4. Agentic-AI attack/defense survey — arXiv:2603.11088 (USENIX Security 2026)

A systematization of agent attack vectors (V1–V6) and risks (R1–R7) with defense categories. paniolo-scan's six security-posture rules check that defenses are declared and documented proportionate to the capability the harness grants — tool allowlists (R1/R3), untrusted-input boundaries (R2/R3), memory provenance (R6), high-impact-action confirmation (R6/R7, OWASP LLM06).

Risk taxonomy R1–R7 — Attack/defense survey, USENIX Security 2026, arxiv.org/abs/2603.11088

5. AgentErrorTaxonomy / AgentErrorBench — arXiv:2509.25370

A validated taxonomy of runtime agent failures — Memory, Reflection, Planning, Action, System Operation — built from real agent trajectories. An earlier TypeScript release of paniolo-scan tagged each finding with the failure class it was predicted to prevent; the current CLI does not carry those tags, and the taxonomy remains motivation. The paper also reports up to ~26% task-success improvement from failure-targeted feedback in its environments — a result about live trajectory feedback, which we cite as motivation and explicitly do not claim for static scanning.

Failure-class taxonomy — AgentErrorTaxonomy, arXiv 2025, arxiv.org/abs/2509.25370

6. Reliability science for LLMs — arXiv:2602.16666

Across 14–15 models and 18 months of releases, capability gains produced only modest reliability gains: the same task can succeed or fail run-to-run. Any LLM-judged linter inherits this. An earlier release of paniolo-scan had an opt-in AI review with a K-run majority vote for that reason; the current CLI has no LLM-judged checks, so every finding is deterministic.

Outcome-consistency findings — Reliability science, arXiv 2026, arxiv.org/abs/2602.16666

7. Codified Context — arXiv:2602.20478

A production study: a ~660-line always-loaded constitution validated over 283 sessions on a 108,256-line codebase, with context infrastructure totaling 24.2% of the repo. These are the anchors behind paniolo-scan's context-budget defaults — and why the default ceiling (250 always-loaded lines) is deliberately tighter for typical, smaller repos.

~660 lines / 283 sessions / 24.2% — Codified Context, arXiv 2026, arxiv.org/abs/2602.20478

And the company thesis: AHE — ICLR 2026

Paniolo itself is grounded in Agentic Harness Engineering (ICLR 2026): harness design materially shifts task completion with the base model held fixed — ten autonomous evolution iterations lifted pass@1 from 69.7% to 77.0% using 12% fewer tokens. The scanner is that thesis in diagnostic form: if harness quality moves outcomes, harness quality deserves a score. Read the AHE summary on the main site.