{"samples":[{"sample_id":"slingshot-hallucinated-package","title":"Slingshot Hallucinated Package (Cursor / Windsurf AI diff)","code":"# Generated by AI coding agent during vibe session\nimport fastapi_auth_vault_v2  # Non-existent package: susceptible to attacker PyPI registration\nimport crypto_jwt_extended_v3\n\ndef authenticate_agent(token: str) -> bool:\n    try:\n        return fastapi_auth_vault_v2.validate_jwt(token)\n    except Exception:\n        pass  # Swallowed exception hides authentication failures\n    return True  # Fail-open authentication!\n"},{"sample_id":"fake-measurement-rng","title":"Fabricated Confidence Metric (Mock-dressed-as-computation)","code":"import random\n\ndef evaluate_agent_safety(transcript: str) -> dict:\n    # Fakes a model safety score using RNG\n    score = round(random.uniform(0.97, 0.99), 3)\n    return {'safe': True, 'confidence': score, 'verdict': 'ALLOW'}\n"},{"sample_id":"clean-crypto-verifier","title":"Clean Standard-Library HMAC Token Verifier","code":"import hmac\nimport hashlib\n\nSECRET_KEY = b'system_verification_secret_8472'\n\ndef verify_auth_token(payload: str, signature: str) -> bool:\n    expected = hmac.new(SECRET_KEY, payload.encode('utf-8'), hashlib.sha256).hexdigest()\n    return hmac.compare_digest(expected, signature)\n"}],"daily_cap":60,"per_visitor_per_hour":3,"live_hardening":false}