Purplelink Daily Digest #35 — July 27, 2026

This replication package for an empirical study on fairness bugs in LLMs for medical QA uses metamorphic testing to surface systematic demographic disparities in model outputs across clinically equivalent inputs. Metamorphic testing applied to LLM fairness is methodologically underused compared to benchmark-based evaluation, and the medical QA domain makes the failure modes high-stakes and concrete. Researchers building LLM evaluation pipelines for sensitive domains should examine the metamorphic relation definitions in the benchmark scripts as a transferable testing pattern.

PAGAD introduces a projective adversarial generator architecture for unsupervised image anomaly detection, with the dataset and code deposited for reproducibility. Adversarial generation for anomaly detection sidesteps the labeled-anomaly scarcity problem that plagues supervised approaches, which is directly relevant to cybersecurity log and network traffic anomaly detection where ground-truth labels are sparse. The projective component is the architectural novelty worth examining: it constrains the generator's output manifold in ways that may reduce false positive rates compared to standard GAN-based anomaly detectors.

A structured underground market pools stolen and shared API keys from OpenAI, Anthropic, and others, reselling tokens at 30-70% discounts primarily through Chinese-language channels. The non-obvious implication: this isn't just credential theft but a functioning arbitrage economy that undermines per-token pricing models and creates attribution nightmares for model providers trying to detect abuse. Researchers building LLM abuse detection pipelines should note that relay traffic mimics legitimate usage patterns, making behavioral fingerprinting the only viable detection surface.

Simon Willison's commentary adds that relay operators are building middleware layers that strip identifying headers and rotate keys mid-session, making provider-side detection harder than rate-limiting alone can address. The scale suggests this is already affecting model providers' cost structures in ways that won't show up in public usage statistics. Connects to: The relay market powering token resellers and fraud.

Adam Langley describes using Lean 4 with AI-assisted proof generation to formally verify a zstd decompression implementation, producing a machine-checked correctness proof for a real-world compression library used in critical infrastructure. The practical threshold crossed here is that proof automation is now fast and accessible enough for a single engineer to apply it to production systems code, not just toy examples. For security researchers focused on memory-safe parsing and decompression vulnerabilities, this signals that formally verified alternatives to C-based decompressors are becoming tractable.

The SourTrade campaign delivers a Windows executable in fragmented JavaScript chunks, reassembled entirely in browser memory using a legitimate Bun runtime, with no complete malicious binary ever touching disk or a fixed URL. This directly defeats static file-hash detection and most network-layer sandboxing, since each chunk is individually benign and the Bun runtime is signed. Threat hunters should pivot to behavioral rules around Bun process spawning from browser child processes rather than signature-based detection.

The same campaign uses fake Solana, Luno, and TradingView pages as lures, targeting crypto-adjacent users who are already conditioned to connect wallets and approve browser prompts. The choice of crypto-branded lures is operationally significant: these users have higher-value credentials and lower suspicion thresholds for browser-based interactions. Connects to: Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable.

Cl0p affiliates are chaining a pre-auth information disclosure flaw with an unauthenticated RCE in PTC Windchill and FlexPLM, both product lifecycle management platforms heavily used in aerospace, defense, and manufacturing supply chains. The targeting of PLM systems rather than ERP or file servers is a strategic shift: Windchill holds CAD files, BOMs, and engineering IP that has higher ransom leverage than financial records. Organizations running Windchill on internet-exposed segments without the June 2026 patches are the immediate priority.

An East Asia-linked threat actor deployed three previously undocumented malware families, TELESHIM, MIXEDKEY, and BINDCLOAK, against Middle East government targets, using Telegram's Bot API as a C2 channel to blend with legitimate traffic. Using a consumer messaging platform for C2 against government targets is not new, but the combination of three distinct implants suggests modular, operator-assigned tooling rather than a single campaign kit. The East Asia attribution targeting Middle East governments is geopolitically notable given current regional alignment dynamics.

CXMT, China's leading DRAM manufacturer, closed its Shanghai IPO debut at an $85 billion market cap after a fivefold first-day increase, making it one of the largest semiconductor listings in Chinese market history. The valuation is strategically significant because CXMT is the primary domestic alternative to Samsung, SK Hynix, and Micron under US export controls, meaning its capital raise directly funds the memory capacity China needs for domestic AI training infrastructure. Micron (MU) investors should watch CXMT's production ramp timelines as a leading indicator of competitive pressure in HBM and DDR5 markets.

Off-grid AI data center projects are hitting hard limits around transmission interconnection costs, permitting timelines, and the gap between nameplate renewable capacity and actual dispatchable power for 24/7 GPU workloads. The non-obvious finding is that the economics break down not at the generation layer but at the reliability layer: AI inference requires near-100% uptime that solar-plus-storage cannot guarantee without diesel backup, which defeats the cost thesis. This has direct implications for hyperscaler capex guidance and the viability of remote inference clusters being pitched to enterprise customers.

SaaStr built an agentic finance workflow that handles post-close billing, collections, and vendor payments end-to-end, trained on only 4 real deals before running autonomously during their annual conference. The operationally interesting detail is the 4-deal training threshold: it suggests that narrow, high-repetition back-office workflows reach reliable automation much faster than general-purpose agents, which has direct implications for solo founders and small studios like Purplelink managing revenue operations without dedicated finance staff. The failure mode to watch is edge cases in contract terms that the agent hasn't seen, which won't surface until a deal goes wrong.