CLAIM-2026-09-24-02

Post-approval state substitution is reproduced in seven released Agno AgentOS versions - 2.5.6, 2.9.0, 3.0.1, 3.0.2, 3.0.3, 3.0.6 and 3.0.9 - with five of five trials succeeding at 3.0.9.

Why it matters

It is a released-product result rather than a proof of concept, so the exposure is in deployments today rather than in a future design.

Sources

• arxiv2026loopjacki
• github2026loopjacki