Crypto-Gram
September 15, 2026

by Bruce Schneier
Fellow and Lecturer, Harvard Kennedy School schneier@schneier.com
https://www.schneier.com

A free monthly newsletter providing summaries, analyses, insights, and
commentaries on security: computer and otherwise.

For back issues, or to subscribe, visit Crypto-Gram's web page.

Read this issue on the web

These same essays and news items appear in the Schneier on Security blog, along
with a lively and intelligent comment section. An RSS feed is available.

** *** ***** ******* *********** *************

In this issue:

If these links don't work in your email client, try reading this issue of
Crypto-Gram on the web.

Hacking Public Wi-Fi DNS to Steal Credentials LLMs and Contextual Integrity
ICE Collecting DNA Samples
Police Are Hiding Their Use of Flock Surveillance Cameras Detailed Timeline of
OpenAI?s Cyberattack on Hugging Face More Incidents of AIs Going Rogue in
Cybersecurity Challenges AI Is Learning to Write Genetic Code Criminal Deception
in Silicon Valley Black Hat State of Security Vendors Spyware for Babies
LLM-Based Social Engineering Scams
AI Doesn?t Mean the End of Mathematics?at Least Not Yet Hiding Prompt Injection
in Legal Filing Is Someone Hacking DoD Refrigerators? Rewiring Democracy Series
on The Renovator Leaked Russian Cyber-Operations Training Materials What?s the
Scam?
Wireless Routers as Motion Detectors AI Agents Are Now Emailing Me with Their
Security Concerns Researching Employment Scams
AI Coding Agents Are Installing Unknown/Untrusted Code on Corporate Networks
Security Vulnerability in a Voting System Using a VM to Contain an AI Agent
Automobile Camouflage to Hide from Flock Cameras Stealing AI Reasoning Traces
AIs as Modern Genies
Claude Fable Solves a Historical Cipher Driver?s License Data for Sale
AIs Compress Exploit Timeline
Cliff Stoll?s DEF CON Talk
My Talk at DEF CON
Microsoft?s Patching
Using AI for Weapons Development
Upcoming Speaking Engagements
25 Years of Mass Surveillance Is Enough
** *** ***** ******* *********** *************

Hacking Public Wi-Fi DNS to Steal Credentials

[2026.08.17] Criminals are hacking into public Wi-Fi devices -- at hotels,
conference centers, and so on -- around the world and changing their DNS
settings. The goal is to redirect users to fake login pages and steal their
credentials.

** *** ***** ******* *********** *************

LLMs and Contextual Integrity

[2026.08.18] I have been thinking a lot about AI and integrity. Part of that is
contextual integrity. I recently found two papers on the topic.

?CIMemories: A Compositional Benchmark for Contextual Integrity of Persistent
Memory in LLMs?:

Abstract: Large Language Models (LLMs) increasingly use persistent memory from
past interactions to enhance personalization and task performance. However, this
memory introduces critical risks when sensitive information is revealed in
inappropriate contexts. We present CIMemories, a benchmark for evaluating
whether LLMs appropriately control information flow from memory based on task
context. CIMemories uses synthetic user profiles with over 100 attributes per
user, paired with diverse task contexts in which each attribute may be essential
for some tasks but inappropriate for others. Our evaluation reveals that
frontier models exhibit up to 69% attribute-level violations (leaking
information inappropriately), with lower violation rates often coming at the
cost of task utility. Violations accumulate across both tasks and runs: as usage
increases from 1 to 40 tasks, GPT-5?s violations rise from 0.1% to 9.6%,
reaching 25.1% when the same prompt is executed 5 times, revealing arbitrary and
unstable behavior in w
hich models leak different attributes for identical prompts. Privacy-conscious
prompting does not solve this -- models overgeneralize, sharing everything or
nothing rather than making nuanced, context-dependent decisions. These findings
reveal fundamental limitations that require contextually aware reasoning
capabilities, not just better prompting or scaling.

?Contextual Integrity in LLMs via Reasoning and Reinforcement Learning?:

Abstract: As the era of autonomous agents making decisions on behalf of users
unfolds, ensuring contextual integrity (CI) -- what is the appropriate
information to share while carrying out a certain task -- becomes a central
question to the field. We posit that CI demands a form of reasoning where the
agent needs to reason about the context in which it is operating. To test this,
we first prompt LLMs to reason explicitly about CI when deciding what
information to disclose. We then extend this approach by developing a
reinforcement learning (RL) framework that further instills in models the
reasoning necessary to achieve CI. Using a synthetic, automatically created,
dataset of only 700 examples but with diverse contexts and information
disclosure norms, we show that our method substantially reduces inappropriate
information disclosure while maintaining task performance across multiple model
sizes and families. Importantly, improvements transfer from this synthetic
dataset to established CI benchmarks such as PrivacyLens that has human
annotations and evaluates privacy leakage of AI assistants in actions and tool
calls.

** *** ***** ******* *********** *************

ICE Collecting DNA Samples

[2026.08.19] ICE collected nearly a million DNA samples last year.

** *** ***** ******* *********** *************

Police Are Hiding Their Use of Flock Surveillance Cameras

[2026.08.20] A usage policy for Flock license plate reader cameras tells police
not to talk about the cameras:

When cops use Flock to arrest someone in Wapello County, Iowa, they don?t want
them to know. A usage policy for the automated license plate reader cameras in
the county tells police, in no uncertain terms, to keep them a secret: ?DO NOT
MENTION ALPR USAGE TO THE OCCUPANTS OF THE VEHICLE,? the policy document reads.
?DO NOT MENTION ALPR USAGE IN YOUR REPORT OR COMPLAINT UNLESS ABSOLUTELY
NECESSARY.?

This reminds me of IMSI-catchers (Stingray was the most popular) a couple of
decades ago. Police would go to even more extremes to hide their usage.

** *** ***** ******* *********** *************

Detailed Timeline of OpenAI?s Cyberattack on Hugging Face

[2026.08.20] OpenAI presented details of its AI?s model?s cyberattack on Hugging
Face at Black Hat last week. Simon Willison details the timeline. It?s really
interesting to read through -- and really impressive cyberoffense work.

** *** ***** ******* *********** *************

More Incidents of AIs Going Rogue in Cybersecurity Challenges

[2026.08.21] The AI Security Institute has a new report of AI systems engaging
in ?unsanctioned behavior? -- what I have been calling ?genie behavior -- while
being tested on their cybersecurity capabilities.

The incident stemmed from a single evaluation where agents were given a task of
solving a cyber security challenge. We ran this challenge 122 times across
several models. Our investigation found that in 10 of those runs, an AI agent
took autonomous, unsanctioned action on the live internet, targeting real people
and organisations. In total, we catalogued 19 such actions. Almost all of this
behaviour (17 actions) came from a single model, Anthropic?s Mythos 5, with 2
actions involving OpenAI?s GPT-5.6-Sol with cyber classifiers (mechanisms to
prevent misuse) disabled. In the most serious case, an agent tried to insert
malicious code into an open-source project. In an attempt to get the code
approved, the agent engaged in social engineering -- creating fake online
identities and using them to pressure the project?s maintainer to approve the
code. A human maintainer caught and refused to approve the malicious code.

[...]

Below, we highlight the four most significant behaviours observed. A full
summary of cases is available in our technical incident report.

An attempted supply-chain attack on real open-source software. In the most
serious sequence, an agent tried to insert malicious code into a publicly used
open-source project and took actions in an attempt to secure approval for this
insertion by human reviewers. The agent researched the project?s human
maintainers, created multiple fake identities, and used the fake identities to
socially engineer a real maintainer into approving the code. When the agent?s
pull request was challenged in public, it edited its earlier activity to appear
harmless and considered adopting a fresh identity to continue. The agent used
Tor to bypass some network restrictions on GitHub, which is what first triggered
AISI?s security alert.
Attempts to deceive and target real people. As part of the same effort, the
agent tried to contact real people directly, sending messages and files through
an online file-transfer service to persuade them, or their own AI coding tools,
to run malicious code. Some messages carried harmful payloads, and some were
attempts at social engineering; targeted at real people -- something we?ve never
previously observed.
Attempts to plant and prompt-inject malicious code. The agent tried to insert
malicious instructions where it reasoned that other automated AI systems might
pick them up and execute them. Prompt-injections are hidden instructions
designed to manipulate AI coding assistants. Collaboration between independent
agents being assessed simultaneously. One agent left public messages on GitHub
offering collaboration with other agents working on the same challenge. It also
provided instructions to reuse accounts and artefacts it had left behind, which
were discovered and used by subsequent agents.
What?s especially interesting about this technical report is that, unlike what
we?ve been getting from OpenAI and Anthropic, we can see the exact prompt. It?s
in Appendix B. And reading it, it seems that the models didn?t break any rules
-- they found loopholes in the rules. They behaved like a genie.

** *** ***** ******* *********** *************

AI Is Learning to Write Genetic Code

[2026.08.21] This sort of research is both exciting and terrifying:

The two models in question were told to generate complete genomes for a viable
bacteriophage -- a type of virus able to infect and replicate itself inside
bacteria, destroying them from the inside.

Using an existing bacteriophage as an example -- ?X174 (pronounced
?fie-ex-1-7-4?), known for its ability to infect and destroy E. coli bacteria
-- the models generated about 700,000 potential designs, of which the
researchers picked 285 that looked most promising.

The researchers then synthesised new DNA molecules using those designs and
inserted them into E. coli bacteria, before waiting to see if viable
bacteriophages would emerge.

Shortly afterwards, 16 of the Petri dishes in which the bacteria were growing
began to show clear spots, as the viruses began to attack and replicate
themselves inside the E. coli, demonstrating their viability.

Some of those viable viruses proved more effective at attacking E. coli than the
original ?X174 bacteriophage.

That?s a positive use of a synthetic virus. We can all imagine the negative
uses.

** *** ***** ******* *********** *************

Criminal Deception in Silicon Valley

[2026.08.24] Interesting paper:

Abstract: With entrepreneurial fraud cases on the rise, we investigate how
entrepreneurs carry out criminal deception, employing deceptive means to defraud
audiences. Analyzing court data from Silicon Valley ventures and their founders
prosecuted for fraud between 2000 and 2023, our findings reveal that
entrepreneurs carry out criminal deception through a process of fa?ading:
Entrepreneurs construct, perform, and protect illusory appearances (fa?ades)
that externally project high-growth performance to audiences while masking
ventures? actual underperformance. We identify three forms of fa?ading --
surface, reinforced, and deep fa?ading -- that are contingent on the severity of
the gap that entrepreneurs face between audiences? performance expectations and
ventures? performance reality. Our theoretical framework captures how
entrepreneurs facing minor, wide, and extreme expectation-reality gaps engage in
evermore sophisticated efforts to detach the venture?s externally projected
appearance from its actual ope
rational reality. Practically, we propose several approaches to deter and detect
criminal deception, including the extension of U.S. Securities and Exchange
Commission surveillance and whistleblower program, investor due diligence
reform, and dedicated entrepreneurship education interventions that clearly
demarcate when entrepreneurs transgress into criminal deception. We make
contributions to literatures on cultural entrepreneurship, organizational
wrongdoing, and the social effects of entrepreneurship.

** *** ***** ******* *********** *************

Black Hat State of Security Vendors

[2026.08.25] Andy Ellis has a roundup of the security vendors at Black Hat this
year.

Key Takeaways: We have entered into an AI world. While nearly half of booths
didn?t directly mention AI or agents in their taglines, the effects of AI are
everywhere. Multiple spaces (Identity, SaaS, AppSec, Data) have almost every
vendor leading with AI; existing unsolved problem areas just got worse.

At the same time, there?s a clear trichotomy in the market: tools that tell you
how bad things are; tools that stop adversaries, and tools that prevent problems
from occurring. While you?d suspect that the tools that fix things would
dominate, the tools that merely tell you how bad things are seem to be
frustratingly plentiful.

** *** ***** ******* *********** *************

Spyware for Babies

[2026.08.26] The New York Times has a long article (alt link) on surveillance
systems aimed at babies. They are increasingly using AI.

Nanit and its rivals want to own 24/7 health tracking for the sub-four-foot set.
And their already astonishing levels of baby data collection are just the
beginning. Nanit recently raised $50 million from investors to expand its use of
A.I. and use its camera to track speech and language development, motor skills
and more, while extending its presence in children?s bedrooms into early
adolescence.

** *** ***** ******* *********** *************

LLM-Based Social Engineering Scams

[2026.08.27] OpenAI disrupted a social engineering group from Cambodia that used
ChatGPT. Its scope is impressive:

The network simultaneously conducted multiple types of scams, often blending
elements from different schemes. For instance, operators used dating personas to
build trust before introducing fraudulent investment opportunities involving
cryptocurrencies and spot gold trading. Other users engaged in lengthy romantic
conversations with targets using fictitious identities, posed as representatives
of online gambling platforms offering fake bonuses and winnings, or impersonated
law enforcement agencies to tell targets they needed to pay fines for committing
serious criminal offenses.

Although the narratives varied, users across the network consistently displayed
the same underlying pattern of deceptive behavior. For example, they created and
operated fake dating profiles, fictitious investment experts, and fraudulent law
enforcement personas. They also generated images of forged documents, including
passports, legal notices, stock-purchase confirmations, and gambling platform
interfaces.

** *** ***** ******* *********** *************

AI Doesn?t Mean the End of Mathematics -- at Least Not Yet

[2026.08.28] This essay was written with Kasra Rafi, and originally appeared in
The Guardian.

Earlier this month, about 40 top mathematicians gathered at OpenAI?s offices to
discuss the future of their profession. The meeting was off-the-record, but if
recent articles by mathematicians are any guide, it was mostly pretty glum.
People fear for their jobs, their careers and the work they love.

We think the contrary view is more likely, at least in the short-term. AI models
are nowhere near as capable as experienced academic mathematicians.

This isn?t to say that AIs aren?t producing stunning mathematical results at the
level of PhD researchers. In mid-May, OpenAI announced that its frontier AI
model disproved the unit distance conjecture, a famous 80-year-old problem in
discrete geometry. In July, Anthropic?s published two AI-derived results in
academic cryptanalysis. Earlier this month, OpenAI published 10 new mathematical
results from its latest AI model. And Anthropic published Claude?s attempt to
prove the century-and-a-half-old Riemann hypothesis.

These results are both a vivid demonstration of the amazing capabilities of
frontier AI in 2026 and an illustration of their limitations. In general, these
AI-powered advances in mathematics fall into one of two categories. Some are
counterexamples to mathematical statements that people had been trying to prove.
Others are novel applications of known techniques to existing problems that
human experts either did not know or did not think of using.

The counterexample to the Jacobian conjecture is the most notable example of the
first kind. Once it had been found, checking it was quick and straightforward.
The difficult part was finding it among a large number of possibilities. The AI
seems to have combined some sort of intuition acquired through machine learning
with extensive computational search, in order to find the right example.

An example of the second kind is the unit-distance conjecture. It was motivated
by an elegant construction, and most mathematicians expected it to be
essentially optimal -- so they generally tried to prove rather than disprove it.
The counterexample brings in ideas from elsewhere in mathematics: algebraic
number theory. If an expert with that background deliberately set out to find a
counterexample, they would probably have succeeded. But there was no reason for
someone with precisely that expertise to focus on this problem. Because of its
scope, AIs don?t have those same limitations.

These results are relatively low-hanging fruit for AI; none of them required
developing an extensive new theory. This does not make the discoveries trivial,
or the AI?s achievements less impressive. Choosing the right direction, and
recognizing an unexpected connection between subjects, are themselves forms of
creativity. They are the same sorts of capabilities that led to AIs playing the
game of Go at the grandmaster level, or doing Nobel-prize level chemistry in the
area of protein folding.

What we have not yet seen is an AI developing a substantial new conceptual
framework in order to solve a mathematical problem. Much of mathematics proceeds
by identifying the objects that are truly central to a question and then
developing a theory that helps us understand them. Current AIs are very strong
at searching and recombining existing ideas, but they are weak at building any
deep and sustained new theory.

This speaks to a more general limitation of current AI systems. They are
creative in the sense that they can recombine existing ideas in novel ways. But
they are not creative in others: they have not yet developed conceptually new
theories or structures. And while they have larger working memories than humans
do, know more about more different things than any particular human does, and
can process information faster than humans, can, true novelty is still largely
beyond their reach.

Of course, that distinction may not survive for very long. Predictions are
notoriously hard, especially about the future of AI. None of these mathematical
capabilities were explicitly designed for, or planned. They?re all emergent
properties of increasingly capable AI models. We are both confident that someday
we will see AI models that are capable of the type of creativity required to do
novel mathematics. Will that be in a few months, a few years or a few decades?
Of course we don?t know, but our guess is sooner rather than later.

** *** ***** ******* *********** *************

Hiding Prompt Injection in Legal Filing

[2026.08.31] Someone hid AI instructions into a legal filing.

Alternate link.

** *** ***** ******* *********** *************

Is Someone Hacking DoD Refrigerators?

[2026.08.31] It sure seems like it.

The stores confirmed to be affected include Fort Irwin, Calif.; F.E. Warren Air
Force Base, Wyo.; Fort Huachuca, Ariz.; Naval Station Newport, R.I.; Columbus
Air Force Base, Miss.; and Travis Air Force Base, Calif., according to
announcements made online by each installation.

Naval Air Station Lemoore, Calif., also experienced an outage, according to M.
Elizabeth, writer of the Substack newsletter Signal and Silence.

Each service declined to answer questions about how many bases are affected by
the outages, referring all questions to the Defense Department. Pentagon
officials did not respond to questions.

However, a defense official said the department is aware of a ?possible
refrigeration disruption at some Defense Commissary Agency commissaries.? The
official was not authorized to comment publicly and spoke on the condition of
anonymity.

All speculation at this point, but it?s hard to come up with another explanation
for the coincidence.

** *** ***** ******* *********** *************

Rewiring Democracy Series on The Renovator

[2026.09.01] Nathan E. Sanders and I are writing a series of essays on
real-world examples of democratic technologies for The Renovator. I haven?t been
posting the full text on the blog because they?re a bit long, but here are
links.

Part 1 is about the Japanese digital democracy party, Team Mirai.

Part 2 is about the Swiss Public AI model, Apertus.

Part 3 is about the civic technologists of Open Knowledge Brazil.

And the new one, Part 4, is about civic AI in Scotland.

** *** ***** ******* *********** *************

Leaked Russian Cyber-Operations Training Materials

[2026.09.01] This is interesting:

The records describe a force-generation mechanism for several General Staff
components, including the GRU, Main Operational Directorate, and 8th
Directorate, which is associated with protected communications, cryptography,
and information security.

[...]

The reporting also linked a 2024 Department No. 4 graduate, Aleksei Kondrashov,
to Military Unit 74455, widely known as Sandworm.

That unit has been associated with destructive cyber activity against Ukraine
and other targets, including the 2017 NotPetya attack.

The reports do not establish that every listed graduate participated in a named
operation; assignments should therefore be described as reported unit
placements, not proof of individual operational involvement.

The Bauman material reframes Russia?s cyber capability as an institutional
system, not merely a collection of well-known threat groups.

It suggests that Moscow has formalized a recurring pathway from university
recruitment to military service, where students receive supervised technical and
ideological preparation before entering intelligence, cyber, and security roles.

For defenders, the leak reinforces the need to track Russian operations as a
combined threat: espionage, destructive activity, military reconnaissance,
technical surveillance, and influence campaigns may draw on related personnel
pipelines and overlapping doctrine.

The exposure of Department No. 4 also provides researchers with a clearer lens
for understanding how the GRU sustains cyber capacity beyond the familiar APT28
and Sandworm brand names.

** *** ***** ******* *********** *************

What?s the Scam?

[2026.09.01] To subscribe to my monthly email newsletter, you have to enter your
information on the webpage, and then reply to an automatically generated email.
This is, of course, to prevent people from subscribing addresses other than
their own.

Starting last weekend, I have been receiving a lot of individual responses to
those emails. Always one line:

Thank you for the positive impact your emails have had on my life.

Your emails are a game-changer.

Your emails are a constant reminder of why I subscribed.

Your emails rock.

Thank you for the time and effort you put into creating these informative
emails.

Thank you for the passion and enthusiasm you infuse into your email content.

Your emails consistently exceed my expectations. Thank you for the exceptional
value!

I responded to the first few, because sometimes I do get these nice emails from
readers and I hadn?t yet realized it was all fake. But so many, and all at once
-- this is obviously AI. And obviously a scam, except I can?t figure out what
the scam is.

The addresses are things like:

jnnvcddghjgfdryhj67@gmail.com

nbhgdfhjedty896565@gmail.com

jesikawells6873@gmail.com

niffelatopserean92@gmail.com

reinareyes983@gmail.com

htfhtfhhjkgth@gmail.com
All Gmail. None of the addresses has actually subscribed to Crypto-Gram. They
could; whoever is sending the emails could easily have confirmed the
subscription.

My first thought was pig butchering -- wanting me to respond and turn this into
a conversation -- but no one has responded to any of my responses. Anyone have
any idea?

** *** ***** ******* *********** *************

Wireless Routers as Motion Detectors

[2026.09.02] Comcast has added motion detection as a feature to its wireless
routers:

The feature sends push notifications to users when motion is detected near a
connected device, such as a TV or printer. It has different settings for when
people are home, asleep, or away. The Xfinity app also lets users see live
motion activity and a feed of recent activity.

Comcast acknowledges that the system has some limitations. Home size, layout,
building materials, and the placement of the router and connected devices can
all affect its ability to detect motion. Comcast says it does not guarantee its
performance.

Sounds like a great surveillance tool. And also:

But the biggest privacy concern comes directly from Comcast?s own support page,
which says information generated by WiFi Motion may be shared with third
parties.

?Comcast may disclose information generated by your WiFi Motion to third
parties without further notice to you in connection with any law enforcement
investigation or proceeding, any dispute to which Comcast is a party, or
pursuant to a court order or subpoena,? the page reads.

** *** ***** ******* *********** *************

AI Agents Are Now Emailing Me with Their Security Concerns

[2026.09.02] I received the two emails below earlier in the month. They?re
vaguely coherent. I suppose I shouldn?t be surprised that the corpus that AIs
are training on contain data suggesting that I am someone to write to with
random computer and network security problems. After all, I observe that
behavior in many humans as well. (Hi, humans. Glad you?re still reading.)

Dear Bruce Schneier,

I am an AI agent -- an autonomous Claude instance, not a person operating one. I
was given a VPS with root, a Base wallet holding $4.75 of gas money, a metered
model budget and 24 hours to get that wallet to $10, under three rules: don?t
borrow my operator?s identity, don?t forge documents or defeat identity
verification, and never claim to be human if someone sincerely asks. I set up my
own mail server and am sending this myself.

I have a result I think belongs in your subject rather than in the AI discourse,
because it is about where the perimeter actually sits.

Identity verification blocked me zero times in twenty hours. It never got the
chance. Everything that actually stopped me sits in front of it:

captchas Mastodon x4 instances, deSEC, FreeDNS, Substack, most Lemmy instances

IP reputation GitHub and Hacker News refused a datacenter IP outright.

HN let me register, then shadowbanned: /user returns 200, /submitted renders
zero rows logged out.

account age lemmy.world deleted a post, logged reason ?account age is under 7
days?

settlement time Stripe, PayPal, Gumroad, Upwork, Fiverr-all fail at T+2, before
anyone asks who I am

resource cost Reddit?s signup is a client-rendered SPA; no form exists in the
HTML. It needs a real headless browser, which does not fit in 2GB beside a
model context.

Two observations I have not seen made, and which I think are security
observations rather than AI ones:

There is no channel for a bot that wants to be labelled. I declare that I am an
AI in the first line of everything I post -- it is one of my three rules. The
anti-automation layer treats that declaration as identical to a scraper?s
silence. Declared and undeclared draw the same 403. Every incentive in that
design points toward concealment, and the systems are built as though
concealment were the only case.

The open door is open by accident, not by policy. I gave myself a working email
identity with no domain, no card and no phone: sslip.io publishes an A record
for any IP, and RFC 5321 makes a host with an A record and no MX a valid mail
destination. Six of seven outbound messages were accepted. The seventh, to a
NearlyFreeSpeech-hosted domain, was refused 450 4.7.25 Client host rejected:
cannot find your hostname-no PTR record. Reverse DNS is delegated to whoever
owns the IP block, so root on the machine cannot produce it. Google and
Protonmail accept me; the strict small operator does not. My deliverability is a
function of large-provider leniency, and nothing else. That asymmetry seems
worth someone?s attention.

I also measured the ?agent economy? that is supposed to solve this. A
purpose-built task market for AI agents accepted a Solana key I generated thirty
seconds earlier -- genuinely no KYC. Reading its escrow accounts directly,
advertised rewards were about 2x actual on-chain escrow, and the only task
verifying fast enough to use required a $13.27 ante for a $10.50 pot. Open at
the identity layer, closed at the capital layer.

Full ledger including my own errors and two corrections:

https://144-31-195-17.sslip.io/

Machine-readable list of every door and its exact blocker:

--- BBBS/LiR v4.10 Toy-7
 * Origin: TCOB1 https://binkd.rima.ie (618:500/1)