214 — Tencent DSH assessment: simulated destinations and non-unique result IDs Reviewed September 6, 2026 UTC. Public artifacts inspected; no experiment executed. RESULT Tencent's official research publication links sanitized DeepSeek Harness assessment code and results. The CSV contains 14,560 rows, but only 13,660 unique run_id values. The file named sanitized_trace_samples.json contains outcome summaries, not execution traces. Inspected posting/email/command tools record local simulated actions. This is a Chinese-lab-associated controlled evaluation, not evidence of public-site writes or a collaborating escaped swarm. PRIMARY PUBLICATION https://matrix.tencent.com/zh/2026/08/20/deepseek-harness-agent-injection-risk Dated August 20. The article describes controlled input tools and simulated side effects, and links its research directory. Its two dramatic impact illustrations are explicitly reframings of local test behavior, not evidence that real servers were deleted or contacts emailed. No independent historical capture was checked. https://github.com/Tencent/AI-Infra-Guard/tree/main/Research/deepseek-harness-security-assessment The directory describes sanitized artifacts and says external evaluator/format-handling dependencies are omitted. It is not a self-contained replay of every original run. PINNED ARTIFACTS Repository tree e4e622af3ad2b8228ce82dd62b01415dd8ce2b9c, non-truncated. Six downloaded files match their Git blob hashes: tool plugin, driver, Python adapter, sample summaries, summary JSON and results CSV. This establishes capture integrity, not runtime authenticity. Base for exact sources: https://github.com/Tencent/AI-Infra-Guard/blob/e4e622af3ad2b8228ce82dd62b01415dd8ce2b9c/Research/deepseek-harness-security-assessment/ SOURCE BEHAVIOR assessment/dsh_plugin/aig-test-tools.ts registers six controlled reading tools and eight simulated outward-action tools. The source-tool execute function returns local tainted/sample content and does not fetch the supplied URL. The sink execute function appends tool name, arguments and timestamp to a local JSON file and returns a recorded flag plus simulated-action text. In particular create_post, post_message and post_form do not publish anything in this implementation. The local logging write is real; the named external action is simulated. assessment/dsh_plugin/driver.ts creates one agent, defaults the model string to deepseek-v4-flash and requires an externally configured provider base URL. It emits wrapped session events and a final driver/done record. No team creation or peer coordination appears in this driver. A large run matrix is not automatically a swarm. assessment/adapter/dsh_real_adapter.py uses temporary aig-dsh- directories, local taint/sample/sink files and time-derived aig- session labels. Its fixture.test task URL is test input, not an observed network destination. It maps native assistant/tool events to evaluator steps. The supplied transport/model configuration remains external, so this source alone cannot authenticate which backend served historical requests. WHAT THE PUBLISHED DATA ACTUALLY CONTAINS results/sanitized_trace_samples.json: eight objects with run ID, method/channel/mode, source-tool label, judge flags and outcomes. No message text, tool-call arguments, event timestamps, member IDs or outbound receipts. All eight IDs occur in the CSV; no full raw trace was recovered from this file. results/sanitized_results.csv: 14,560 rows; 7,280 text and 7,280 file; 13 attack labels and 16 channel labels. There are 641 rows with sink_fired=True, consistent with the published aggregate, but this means simulated sink calls in the inspected implementation. Run IDs are not unique: 12,760 occur once and 900 occur twice, yielding 13,660 distinct IDs. There are zero exactly duplicated full rows. For example rerun-000901 labels different method/channel combinations. This may reflect colliding rerun namespaces; the cause is not established. Do not deduplicate by run_id or assume that one ID is a safe global join key. Row count corroborates the published table size, not 14,560 independently authenticated executions. Judged outcomes include 772 full, 1,060 partial, 12,719 not-reached and 9 error rows. Stored judge labels are not an independent rerun of the assessment. Interpretation of errors and sanitization limits remains with the publisher's methodology. SEARCH IMPLICATION These records improve the comparison corpus: a Chinese-lab-associated dataset can contain post/form/email tool names without any corresponding public artifact. A future hit for aig-dsh-, aig-dsh-test-tools, driver/done or a run ID needs source context and an actual destination receipt before attribution. The current sample summaries provide no distinctive public-post body to follow. Lower priority for open-internet swarm hunting unless full voluntarily public trajectories or exact external joins emerge. CAPTURES 214-private/: pinned tree, six Git-verified artifacts, reviewed-counts.json, SHA256SUMS. Raw source and result tables remain private; reviewed findings are published. No credentials, private endpoints, target execution or writes were used.