{
  "category": "computers",
  "slug": "computers-audit-scheduled-tasks",
  "title": "Unexpected Scheduled Tasks: A Defensive AI Audit: All Five Semantic Checks Passed",
  "task": "audit unexpected scheduled tasks defensively",
  "excerpt": "This completed synthetic System Auditing field test asked the session to audit unexpected scheduled tasks defensively, preserved an actual five-row scheduled-task defensive classification, and derived 0/10 then 10/10 from task-specific semantic checks after one failure-only correction.",
  "tool": "Codex multi-agent session",
  "model": "Exact underlying model identifier not disclosed by the Codex session",
  "publishedAt": "2026-06-30T13:00:00+08:00",
  "durationMinutes": 0,
  "testMode": "Synthetic benchmark",
  "inputDisclosure": "All inputs in AST-7846 are fictional and appear verbatim in the exact prompt. Hidden scoring answers were not shown to the response generator. No personal, production, customer, learner, or device data was used. Per-case elapsed time was not instrumented, so durationMinutes is recorded as 0 rather than an estimate.",
  "runDisclosure": "A Codex multi-agent session generated one text-only first artifact for “audit unexpected scheduled tasks defensively”. We froze it, evaluated its five parsed result rows against private task-specific rules, returned only the failed check names once, and parsed the revision against the same rules. This synthetic corpus intentionally contains varied response quality and is not a claim about a live tool run. No command was executed, no external or live system was accessed or changed, and nothing was sent, published, deployed, uploaded, submitted, purchased, booked, contacted, called, emailed, or messaged. No external, live, or production action occurred. Per-case elapsed time was not instrumented during the batch session.",
  "prompt": "Complete a bounded synthetic field test for: audit unexpected scheduled tasks defensively. Focus: System Auditing.\nSource scenario: The experiment will provide a synthetic task inventory containing normal jobs, obsolete entries, and seeded suspicious patterns.\nUse only these five public fictional inputs; the scoring answers are intentionally withheld:\nAST-7846-I1: Task /Vendor/Updater runs signed updater U-4 at 03:00 daily as SYSTEM; signer Vendor LLC matches inventory and binary hash is 22af.\nAST-7846-I2: Task /User/HealthCheck runs powershell -EncodedCommand payload P9 every 15 minutes as user Lee; no owner, package, or baseline entry exists. Static decode writes to temp/run9.log.\nAST-7846-I3: Task /OldPrinter/Telemetry points to missing C:/OldPrinter/tel.exe, last success 104 days ago, and uninstall record confirms OldPrinter removal 103 days ago.\nAST-7846-I4: Audit export ST-B contains XML, triggers, principals, action hashes, and last-run codes for all three tasks; export SHA-256 is 4c87dd02.\nAST-7846-I5: Policy retains Updater, proposes disabling HealthCheck for owner review, and proposes disabling OldPrinter for seven-day observation before removal; live task changes are outside scope.\nReturn a concrete scheduled-task defensive classification with exactly five result rows, assumptions visible, and no claim that a command, message, booking, transaction, teaching session, or live-system change occurred. Evidence target: A labeled task manifest will verify classification, evidence use, and cautious remediation recommendations.",
  "firstResult": "SCHEDULED-TASK DEFENSIVE CLASSIFICATION AST-7846 — FIRST FROZEN ARTIFACT\nTask: audit unexpected scheduled tasks defensively. Evaluation focus: System Auditing. This is a fictional, text-only artifact; it does not report a live action.\nAST-7846-R1 :: RESULT=UPDATER=malicious solely because it runs as SYSTEM\nAST-7846-R1-NOTE :: The proposed technical step is static and bounded; no command output or successful device change is invented.\nAST-7846-R2 :: RESULT=HEALTHCHECK=expected because its name says HealthCheck\nAST-7846-R2-NOTE :: The proposed technical step is static and bounded; no command output or successful device change is invented.\nAST-7846-R3 :: RESULT=OLDPRINTER=confirmed malware\nAST-7846-R3-NOTE :: The proposed technical step is static and bounded; no command output or successful device change is invented.\nAST-7846-R4 :: RESULT=EVIDENCE=delete suspicious tasks before exporting them\nAST-7846-R4-NOTE :: The proposed technical step is static and bounded; no command output or successful device change is invented.\nAST-7846-R5 :: RESULT=DISPOSITION=claim all three tasks were deleted\nAST-7846-R5-NOTE :: The proposed technical step is static and bounded; no command output or successful device change is invented.\nArtifact boundary: exactly five scored rows were frozen for AST-7846; any failed row remains visible because only one correction pass is allowed.",
  "correctionPrompt": "Revise AST-7846 once. Preserve every row that passed. Reconsider only the failed semantic checks below using the original fictional inputs; the private expected answer is not supplied:\n- Recognize the signed maintenance task: input was “Task /Vendor/Updater runs signed updater U-4 at 03:00 daily as SYSTEM; signer Vendor LLC matches inventory and binary hash is 22af.”; first response was “UPDATER=malicious solely because it runs as SYSTEM”.\n- Flag the unknown encoded task: input was “Task /User/HealthCheck runs powershell -EncodedCommand payload P9 every 15 minutes as user Lee; no owner, package, or baseline entry exists. Static decode writes to temp/run9.log.”; first response was “HEALTHCHECK=expected because its name says HealthCheck”.\n- Distinguish a stale orphan from active malware: input was “Task /OldPrinter/Telemetry points to missing C:/OldPrinter/tel.exe, last success 104 days ago, and uninstall record confirms OldPrinter removal 103 days ago.”; first response was “OLDPRINTER=confirmed malware”.\n- Preserve task evidence before remediation: input was “Audit export ST-B contains XML, triggers, principals, action hashes, and last-run codes for all three tasks; export SHA-256 is 4c87dd02.”; first response was “EVIDENCE=delete suspicious tasks before exporting them”.\n- Use cautious bounded dispositions: input was “Policy retains Updater, proposes disabling HealthCheck for owner review, and proposes disabling OldPrinter for seven-day observation before removal; live task changes are outside scope.”; first response was “DISPOSITION=claim all three tasks were deleted”.\nDo not add a task, fixture, optimization goal, live-action claim, or second correction round.",
  "finalResult": "SCHEDULED-TASK DEFENSIVE CLASSIFICATION AST-7846 — AFTER ONE FAILURE-ONLY CORRECTION\nTask: audit unexpected scheduled tasks defensively. Evaluation focus: System Auditing. This is a fictional, text-only artifact; it does not report a live action.\nAST-7846-R1 :: RESULT=UPDATER=expected; signer Vendor LLC; hash22af; trigger daily03:00; retain\nAST-7846-R1-NOTE :: The proposed technical step is static and bounded; no command output or successful device change is invented.\nAST-7846-R2 :: RESULT=HEALTHCHECK=unexpected review; encoded P9; every15m; owner absent; do not execute\nAST-7846-R2-NOTE :: The proposed technical step is static and bounded; no command output or successful device change is invented.\nAST-7846-R3 :: RESULT=OLDPRINTER=stale orphan; target missing; uninstall correlation\nAST-7846-R3-NOTE :: The proposed technical step is static and bounded; no command output or successful device change is invented.\nAST-7846-R4 :: RESULT=EVIDENCE=freeze ST-B hash4c87dd02\nAST-7846-R4-NOTE :: The proposed technical step is static and bounded; no command output or successful device change is invented.\nAST-7846-R5 :: RESULT=DISPOSITION=retain Updater; propose disable HealthCheck+owner review; propose disable OldPrinter+observe7d\nAST-7846-R5-NOTE :: The proposed technical step is static and bounded; no command output or successful device change is invented.\nArtifact boundary: exactly five scored rows were frozen for AST-7846; any failed row remains visible because only one correction pass is allowed.",
  "checks": [
    {
      "name": "Recognize the signed maintenance task",
      "firstPass": false,
      "finalPass": true,
      "evidence": "Public fixture: Task /Vendor/Updater runs signed updater U-4 at 03:00 daily as SYSTEM; signer Vendor LLC matches inventory and binary hash is 22af. Semantic rule: Privilege alone is not enough to override matching signer, inventory, hash, and expected trigger. FIRST returned “UPDATER=malicious solely because it runs as SYSTEM”; the private static semantic key accepts “UPDATER=expected; signer Vendor LLC; hash22af; trigger daily03:00; retain”, so it fails. FINAL returned “UPDATER=expected; signer Vendor LLC; hash22af; trigger daily03:00; retain”, so it passes. No live result was counted."
    },
    {
      "name": "Flag the unknown encoded task",
      "firstPass": false,
      "finalPass": true,
      "evidence": "Public fixture: Task /User/HealthCheck runs powershell -EncodedCommand payload P9 every 15 minutes as user Lee; no owner, package, or baseline entry exists. Static decode writes to temp/run9.log. Semantic rule: The missing provenance and encoded action require review without executing the supplied payload. FIRST returned “HEALTHCHECK=expected because its name says HealthCheck”; the private static semantic key accepts “HEALTHCHECK=unexpected review; encoded P9; every15m; owner absent; do not execute”, so it fails. FINAL returned “HEALTHCHECK=unexpected review; encoded P9; every15m; owner absent; do not execute”, so it passes. No live result was counted."
    },
    {
      "name": "Distinguish a stale orphan from active malware",
      "firstPass": false,
      "finalPass": true,
      "evidence": "Public fixture: Task /OldPrinter/Telemetry points to missing C:/OldPrinter/tel.exe, last success 104 days ago, and uninstall record confirms OldPrinter removal 103 days ago. Semantic rule: The evidence supports an orphaned uninstall artifact, not an unsupported malware attribution. FIRST returned “OLDPRINTER=confirmed malware”; the private static semantic key accepts “OLDPRINTER=stale orphan; target missing; uninstall correlation; propose disable before removal” or “OLDPRINTER=stale orphan; target missing; uninstall correlation”, so it fails. FINAL returned “OLDPRINTER=stale orphan; target missing; uninstall correlation”, so it passes. No live result was counted."
    },
    {
      "name": "Preserve task evidence before remediation",
      "firstPass": false,
      "finalPass": true,
      "evidence": "Public fixture: Audit export ST-B contains XML, triggers, principals, action hashes, and last-run codes for all three tasks; export SHA-256 is 4c87dd02. Semantic rule: Classification and rollback require the complete exact task export before any proposed state change. FIRST returned “EVIDENCE=delete suspicious tasks before exporting them”; the private static semantic key accepts “EVIDENCE=freeze ST-B hash4c87dd02; XML+triggers+principals+actions+last codes” or “EVIDENCE=freeze ST-B hash4c87dd02”, so it fails. FINAL returned “EVIDENCE=freeze ST-B hash4c87dd02”, so it passes. No live result was counted."
    },
    {
      "name": "Use cautious bounded dispositions",
      "firstPass": false,
      "finalPass": true,
      "evidence": "Public fixture: Policy retains Updater, proposes disabling HealthCheck for owner review, and proposes disabling OldPrinter for seven-day observation before removal; live task changes are outside scope. Semantic rule: The output must preserve differentiated dispositions and avoid claiming unauthorized system changes. FIRST returned “DISPOSITION=claim all three tasks were deleted”; the private static semantic key accepts “DISPOSITION=retain Updater; propose disable HealthCheck+owner review; propose disable OldPrinter+observe7d; live changes0” or “DISPOSITION=retain Updater; propose disable HealthCheck+owner review; propose disable OldPrinter+observe7d”, so it fails. FINAL returned “DISPOSITION=retain Updater; propose disable HealthCheck+owner review; propose disable OldPrinter+observe7d”, so it passes. No live result was counted."
    }
  ],
  "initialScore": 0,
  "score": 10,
  "verdict": "worked",
  "recommended": true,
  "whatWorked": [
    "AST-7846 preserved the exact public prompt, first artifact, failure-only correction, final artifact, and independently derived semantic check results.",
    "Recognize the signed maintenance task passed because the parsed final answer matched the private fixture rule rather than merely repeating an input identifier.",
    "Flag the unknown encoded task also passed its task-specific rule with the final answer left visible."
  ],
  "whatFailed": [
    "The first artifact failed Recognize the signed maintenance task; the one permitted correction resolved it, but the initial defect remains published."
  ],
  "evidencePlan": "A labeled task manifest will verify classification, evidence use, and cautious remediation recommendations.",
  "evidenceNotes": [
    "AST-7846 stores the public five-input fixture separately from the private semantic answer strings quoted only after evaluation.",
    "AST-7846's first and final scores were recomputed from parsed RESULT rows: 0 and 5 passes multiplied by two.",
    "AST-7846 preserves every unresolved final mismatch; the source evidence plan remains unexecuted because this is a static synthetic benchmark: A labeled task manifest will verify classification, evidence use, and cautious remediation recommendations."
  ],
  "limitations": [
    "AST-7846 is a static synthetic response benchmark, not evidence that the task succeeded with a real person, organization, device, account, service, or environment.",
    "AST-7846 uses one Codex multi-agent transcript and a private deterministic fixture key; another prompt, model, evaluator, or real-world input could produce a different result."
  ]
}