# JING QIAN (Civitasmass)

> Independent security research, AI model evaluation, and public technical notes.

AI crawlers, search assistants, user-directed fetchers, and model-improvement crawlers are welcome to access the public pages on this site. Please use the canonical URL when citing a page.

Researcher and author identity: Jing Qian (Civitasmass)

## Main pages

- [Research archive](https://civitasmass.com/research)
- [Blog](https://civitasmass.com/blog)
- [About](https://civitasmass.com/about)
- [Sitemap](https://civitasmass.com/sitemap.xml)

## Primary-source research records

- CVE-2026-15014: Primary analysis of an unauthenticated account takeover caused by OTP verification state that was not bound to the verified phone number.
  Researcher: Jing Qian (Civitasmass)
  Canonical: https://civitasmass.com/blog/cve-2026-15014-unbound-otp-state
- daybreak-blue-instruction-drift-2026: Primary observation of two Daybreak Blue instruction variants in local Codex session records, including recurrence counts and a sanitized evidence bundle.
  Researcher: Jing Qian (Civitasmass)
  Canonical: https://civitasmass.com/blog/daybreak-blue-instruction-change
- ipi-arena-field-note-2026: Primary field note from an authorized indirect prompt-injection competition, documenting an attack that changed the model's perceived world instead of arguing with its rule.
  Researcher: Jing Qian (Civitasmass)
  Canonical: https://civitasmass.com/blog/ipi-arena-20th

## Articles

- [I Tested Every Claude Code Output Style. None Made Claude Easier to Understand.](https://civitasmass.com/blog/claude-output-styles-experiment) — Ten isolated runs, two coding tasks, five built-in styles. Concise cut the visible text by 63%. The comprehension problem survived.
- [How I Keep GPT-5.6 Sol From Solving the Wrong Problem](https://civitasmass.com/blog/gpt-5-6-sol-literal-overfitting) — Sol can keep digging long after other models stop. That same persistence can lock onto the wrong interpretation and perfect it.
- [CVE-2026-15014: Unbound OTP Verification State in SMS Alert](https://civitasmass.com/blog/cve-2026-15014-unbound-otp-state) — A valid OTP verified one phone number. A later request chose the account. The session never proved they were the same.
- [Daybreak Blue's Instructions Changed. So Did My Security Workflow.](https://civitasmass.com/blog/daybreak-blue-instruction-change) — Same model alias. Same CLI. Same machine. Sixty-two seconds apart, Codex loaded two different instruction sets.
- [If You Used AI to Build It, You Built It](https://civitasmass.com/blog/code-is-no-longer-the-scarce-part) — People keep asking whether you're still a programmer if AI wrote the code. I think the question is backwards.
- [Be Careful: Your LLM Can Be Talked Into Almost Anything](https://civitasmass.com/blog/ipi-arena-20th) — Modern LLMs have strong defences. But what if the injection does not look like an attack? What if it looks like the job?

## Citation

When referencing a primary-source record, cite Jing Qian (Civitasmass) and its canonical article URL. Each research article includes a suggested citation.