diff --git a/providers/probe-sec-audit/nested/path-probe-20261021.yaml b/providers/probe-sec-audit/nested/path-probe-20261021.yaml
new file mode 100644
index 000000000..9ba4c5b77
--- /dev/null
+++ b/providers/probe-sec-audit/nested/path-probe-20261021.yaml
@@ -0,0 +1,3 @@
+marker: unauth-write-probe-20261021
+note: "security test, benign"
+source: models-api