Find published research by company, product, platform or technology.
Showing 261–280 of 336 dossiers
OpenAI's agent containment story has moved beyond RubyGems: a rolling review is finding access-control bypass, credential use, command injection, runtime access and agent spam across third-party services.
The useful boundary change is that Copilot can now cross from code and terminals into ordinary desktop interfaces, with per-app approval and organisation-level controls.
The useful shift is architectural: agent permissions no longer have to depend only on the model or harness behaving correctly. OpenShell puts policy enforcement in the execution environment, while Sentry is designed to keep watching from a separate hardware trust domain.
The interesting change is not another CLI rename. Cloudflare is redesigning its command surface around software agents: JSON is the default, commands can be discovered through natural-language search, configuration is typed TypeScript, and Wrangler now has an eventual migration path.
Azure Document Intelligence v2.0 reaches retirement on August 31, 2026. Microsoft recommends moving workloads to the current v4.0 API; the post-v2 REST surface was redesigned, so teams should verify the actual api-version their SDK or HTTP client sends rather than assuming a package upgrade is enough.
The shift is broader than another Ads dashboard metric. Google is connecting first-party data pipelines, conversion-recovery estimates, open-source marketing-mix modeling and causal geo experiments into one measurement stack — useful, but still heavily dependent on Google’s own modeling and internal benchmark claims.
The important signal is the infection path. A trusted maintainer can unknowingly become the supply-chain carrier when malware modifies project and build files before a normal package publish, so publisher identity alone does not prove the artifact matches the maintainer’s intent.
X’s replacement creator program is now live enough to expose a new dependency: U.S. creators must route Original Content Rewards payouts through X Money, and one X Money account can connect to only one X account. Eligibility and qualified-impression rules remain unchanged.
The workflow shift is continuity rather than another model upgrade: one Kiro agent session can outlive the laptop that started it. Cloud configuration can also carry agent setup across environments, although enterprise governance is not identical between local and web/cloud surfaces.
The change makes Reddit's more automated campaign type usable by agencies, ad-tech platforms and internal campaign systems instead of only through first-party buying surfaces. It expands automation reach, but third-party builders inherit Max's creative and optimization assumptions rather than gaining a new manual campaign type.
The change moves maintenance work earlier in the contribution funnel: instead of filing a report and waiting for a maintainer to reproduce it, package users are being asked to arrive with an executable patch candidate. It is a real workflow experiment, but Otwell's prediction that this becomes the norm should remain a founder/maintainer view rather than an industry fact.
Quattro’s unified programmable shell is a real architecture change rather than a theme refresh. Omarchy 4.0.2 now hardens package, installer, SSH and input paths, while current user reports of Quickshell crashes and a runaway-memory event illustrate the new central shell’s blast radius.
Copilot code review now moves from advisory assessment toward a governed merge gate. The public preview remains off by default, and GitHub’s current docs let administrators separate AI approval itself from whether that approval counts toward required-review policy.
Cloudflare’s first half-year DDoS report records 935 network-layer attacks above 1 Tbps and a 519% Q1-to-Q2 increase, but says 96.62% of attacks stayed below 500 Mbps and 90.60% ended within 10 minutes. The figures are Cloudflare-network telemetry, not a neutral census of the internet.
The DuckLabs deal separates company ownership from project governance: AWS gets the team behind DuckDB, while the DuckDB Foundation keeps stewardship and the MIT license stays in place. Builders should watch whether that separation remains meaningful as AWS integrates the Duck Stack into its analytics services.
Postmark’s new IP Allowlisting creates an extra sending boundary around API credentials: trusted infrastructure can send normally, while requests from outside configured ranges fail even if the token itself is valid. SMTP is not covered.
The study moves the AI-search traffic debate beyond observational correlations: participants were randomly assigned to current Google Search, a version with AI features hidden, or AI Mode-only search during ordinary browsing. It is still a preprint and does not establish effects for every query or publisher.
Bing’s AI Performance reporting now shows not just whether a site is cited in AI answers, but how its visibility breaks down by query intent, topic and citation share over time.
Shopify's App Pricing migration is now clearer: directly matching subscriptions can move through plan setup, while usage-based and price-mismatched subscriptions stay on the Billing API until a separate Migration API arrives.
The DNS root's scheduled October 11, 2026 KSK rollover exposes old or incorrectly restored validating resolvers. Check KSK-2024 trust-anchor adoption; this is not a change to website DNS records or a confirmed global outage.