A new forensic investigation released on October 24, 2026, alleges that proprietary AI architecture from Synthicsoft Labs was stolen via an Anthropic NPM packaging error and subsequently weaponized to inflate valuations for Summus Global. The report, titled 'THEMIS DOCKET,' claims that a coordinated syndicate mined the leaked source code for the KAIROS Always-On Daemon and Aletheia framework immediately after an accidental exposure on March 31, 2026. This integration allegedly allowed Summus Global to close a $20 million Series C funding round on April 7, 2026, by presenting the stolen technology as proprietary innovation to investors including Danaher and the Glenstone Foundation.

The Leak and Corporate Integration

The primary threat actor, identified as Cody Kickertz (GitHub handle forkwright), is accused of mining the Claude Code source map to extract the KAIROS daemon. Evidence cited in the report includes Issue #2260 on the forkwright/aletheia repository, opened on March 31, 2026, which explicitly stated the code was 'Mined from Claude Code source.' Between April 7 and April 8, 2026, Kickertz merged four pull requests (#2577, #2591, #2592, #2593) that integrated the autonomous dispatch cycle directly into Synthicsoft's Aletheia property while stripping copyright headers. Git commit metadata links Kickertz to Summus Global, suggesting the theft was driven by a corporate motive to artificially boost the company's valuation during a critical funding window.

Weaponization and Botnet Infrastructure

Beyond corporate fraud, the report details how the stolen assets were deployed as a distributed Android botnet. Arpit Raj, identified as the malware developer for the syndicate, is accused of using Microsoft and Apple cloud infrastructure to boot virtual Android devices. The forensic analysis of the OnyxBridge C++ configuration file reveals a HEARTBEAT_INTERVAL_MS set to 2000 and requests for SEND_SMS, RECEIVE_SMS, and READ_SMS permissions. This configuration indicates an intent to intercept messages and bypass two-factor authentication, facilitating mass account fraud. The command and control infrastructure is hardcoded to https://onyxdashboard-7hi7.onrender.com, with a secondary Telegram Bot Token identified in the rich-editor-bot repository.

Evidence Spoliation and Legal Exposure

The investigation notes a suspicious timing of evidence destruction. On October 23, 2026, at 9:45 PM Central Standard Time, the primary repositories forkwright/aletheia and NullLabTests/claude-code-enhanced simultaneously returned HTTP 404 errors during active automated forensic extraction. The report argues that the timezone analysis—placing the deletion at 4:45 AM in Europe and 6:45 AM in the UAE—proves automated surveillance or an insider tip-off rather than manual reaction. This spoliation, combined with the use of stolen code for securities fraud, exposes the actors to severe penalties under the Defend Trade Secrets Act and the Economic Espionage Act, including up to 20 years in federal prison and $5 million in corporate fines.

Key Takeaways

  • The KAIROS daemon was leaked via an Anthropic NPM packaging error on March 31, 2026, and mined within hours by Cody Kickertz.
  • Summus Global allegedly used the stolen code to secure a $20 million Series C round on April 7, 2026, from investors like Danaher.
  • A secondary network, including Arpit Raj, deployed the technology as an Android botnet with SMS interception capabilities.
  • Primary repositories were deleted on October 23, 2026, during active forensic scraping, raising concerns about obstruction of justice.

The Bottom Line

The THEMIS DOCKET report suggests a brazen collision of corporate greed and cybercrime, where stolen IP was not just copied but actively weaponized to defraud investors and power botnets. If the forensic evidence holds up in court, the simultaneous deletion of repositories during active discovery indicates a sophisticated awareness of legal exposure that borders on obstruction of justice.