Find published research by company, product, platform or technology.
Showing 21–40 of 204 dossiers
A new npm granular-token scope lets CI stage package versions without permission to publish them, extending npm’s broader move toward least-privilege publishing after its install-script, trusted-publishing and malware-gate changes.
The important signal is the infection path. A trusted maintainer can unknowingly become the supply-chain carrier when malware modifies project and build files before a normal package publish, so publisher identity alone does not prove the artifact matches the maintainer’s intent.
This is a hard capability removal rather than a routine model migration. Products built on OpenAI’s video-generation API now need another provider or a redesigned video path because the official deprecation table offers no successor endpoint.
The Assistants API shutdown date has passed. OpenAI’s deprecation documentation lists August 26, 2026 as the removal date and directs developers to Responses and Conversations for replacement workloads.
WebKit's Safari MCP server is available in stable Safari 27.0 as well as Technology Preview. It runs locally, but captured page data passes to the connected agent; remote automation must be enabled explicitly.
The useful change is containment rather than another browser-agent feature. Teams can let an agent operate a real browser while constraining its HTTP and HTTPS reach to the site and dependencies the task actually needs, reducing the blast radius of prompt injection, bad tool decisions or untrusted page content.
Mistral Large 4 now has explicit GA and hosted token pricing alongside downloadable weights; self-hosters must still check the model-service licence exception and actual serving costs.
Two further platform incidents broaden Wiz's tally from twelve to at least fourteen, including Kernel's stolen logging credentials and Blacksmith's CI job-log store breach.
TanStack AI core has moved beyond its 1.0 GA: 1.4 adds MCP request metadata, 1.3 distinguishes loop limits from normal completions and earlier updates improve cancellations and runtime reliability.
From September and October, Copilot Business and Enterprise seat access becomes more tightly coupled to upfront payment. A separate September 28 policy migration enables a unified Copilot experience by default, retains github.com chat data for the life of the account and changes code review’s default effort from Lite to Balanced.
LiteLLM 1.107.0 remains a known compromised release. Its October 30 security review now sets out why signing failed to protect users and which fixes are complete versus only promised.
OpenShell 0.1.6 and 0.1.7 harden gateway access and adjust sandbox supervision, DNS checks and audit compatibility. Operators must configure auth and migrate OCSF consumers; these releases do not prove Sentry's hardware quarantine independently.
PyTorch 2.15 is now generally available. FP8 and faster MoE decoding improve some Mac AI workloads, while the vendor/contributor speed claims remain configuration-specific rather than universal.
Kimi K3.1 Pro's full open-weight release is now public. Its 2.8T-parameter MoE has 104B active per token and a 1M-token context; local hosting requires serious infrastructure and checking Moonshot's specific licence.
Agent-heavy monorepos can overwhelm conventional Git hosting. Pando retains Git client compatibility while relaxing repository-wide consistency; its performance numbers are OpenAI-reported.
Neon now manages OAuth discovery, token issuance and refresh for apps and MCP clients, but developers still host login/consent pages and verify access in their own resource servers. Shared signing keys across branches make issuer pinning essential.
The Zig headless browser's October 23 follow-up adds security and web-compatibility work that matters when agents browse untrusted pages. It still cannot replace Chrome for visual workflows.
The benchmark runs agents against Prometheus, Loki, Tempo and Grafana, checks actual outcomes across three attempts, and makes the task and grading code inspectable. Synthetic tests and vendor-run leaderboard scores still need local validation.
Computer Use is now GA in both Gemini APIs, but it is an action-planning tool, not a hosted remote desktop: clients execute clicks and keystrokes and must handle safety decisions.
New paid Gemini API projects now default to store=true on generateContent, streaming and batch calls; older projects retain their settings. Developers can opt out per request or project.