feat: AVE-2026-00070 -- distributed cross-agent backdoor fragments (Collaborative Shadows)

[chaksaray]

Summary

AVE-2026-00070: distributed cross-agent backdoor fragments, "Collaborative Shadows" (MEDIUM, AIVSS 6.4). Fifth and final record from the eight-candidate verification audit's genuine gaps.

Why this is a genuine gap

Confirmed distinct from AVE-2026-00059 (ShareLock) on every axis that matters:

	ShareLock (00059)	This record
Fragment location	One client's static tool.description fields	Multiple distinct agents' own memories/observations
Reassembly actor	The model itself, in-context, at inference time	An attacker, externally, offline, after the run
Trigger	A single planted trigger read by one model	A specific multi-agent collaboration sequence
Scope	Single session	Multiple agents

Same fragmentation family (evade per-artifact review by splitting a payload), genuinely different mechanism.

Sourcing

arXiv 2510.11246, "Collaborative Shadows: Distributed Backdoor Attacks in LLM-Based Multi-Agent Systems." Attack success rate exceeding 95%, no degradation to benign task performance, evaluated on a custom multi-role benchmark, code and benchmark published.

AIVSS notes

multi_agent and persistent_memory both scored at AARF maximum, correctly: the mechanism is definitionally both (fragments spread across distinct agents, must survive in memory between poisoning and external reassembly).

Framework mappings, researched not assumed

• owasp_mcp: ["MCP03"] (Tool Poisoning) and owasp_asi: ["ASI06", "ASI07"] (Memory & Context Poisoning; Insecure Inter-Agent Communication) verified against each framework's own published category list.
• mitre_atlas and nist_ai_rmf are deliberate empty arrays: a candidate ATLAS technique (AI Agent Context Poisoning: Memory) could not be verified against MITRE's own data repository despite genuine effort (repeated fetch attempts against the primary source). Independent research explicitly confirms "agent-to-agent lateral movement" and "cross-session memory persistence" as documented gaps in current ATLAS coverage -- consistent with finding nothing to cite with confidence, not a research shortfall.

Validation

• python3 scripts/validate_records.py: all 66 records valid.
• python3 scripts/check_fixtures.py: all 66 records have positive + negative fixtures.
• pytest tests/ -x -q: 264 passed.
• No vendor boilerplate, no "AVE Technical Writeup" reference.
• node scripts/build-records.js: dist regenerated; frozen v1.1.0 snapshot untouched.
• README badge/stats/index and CHANGELOG updated in this commit.

Scope notes

No detection-rule PR in bawbel/scanner -- separate tracker. This is the last of five records drafted from the audit sweep (AVE-2026-00066 through 00070, PRs #113-#116 and this one).