Find published research by company, product, platform or technology.
Showing 21–40 of 145 dossiers
Muse packages persistent autonomous execution, credentials, payments, app access and memory into a mainstream consumer product. A September macOS hotfix now provides an early real-world lesson: agent containment has to protect not only the cloud runtime but also the local control path into the agent.
The change separates three things that are often bundled together: the harness, the subscription that pays for it, and the sandbox that executes it. Builders can switch among supported coding agents behind one interface while reusing existing subscription access and reducing credential exposure inside agent runtimes.
The useful change is where enforcement happens. Teams can now make unresolved leaked credentials a branch-policy failure, with organization and enterprise rollout plus API configuration for large repository fleets.
The corrected rollout matters for supply-chain configuration: teams can still remove PATs for qualifying GitHub Packages, but GitHub changed the precedence model after some npm update jobs were mistakenly routed through GitHub Packages.
The technical-preview feature separates Copilot CLI from GitHub Cloud for core coding, shell and repository workflows, giving regulated and isolated environments a supported agent path while leaving cloud-dependent capabilities such as GitHub-hosted model selection and web search unavailable.
This is not a speculative browser bug. The vulnerable code sits in Chrome’s JavaScript and WebAssembly engine, exploitation is confirmed, and the remediation boundary is concrete: desktop Chrome needs the September 3 patched build or later.
The AI Compute Partnership tied Nvidia more directly to the capital structure and utilization risk of emerging cloud providers. Reuters says the initiative is now paused amid concerns about circular demand, control over partners and antitrust exposure, although Nvidia says the broader compute-access model continues to evolve.
Railway Cloud Agents are managed, persistent development machines rather than a new model or harness. They reuse developers’ existing agent credentials, sleep when disconnected by default, retain disk state, and live inside Railway project environments—blurring the boundary between remote coding workspace and deployment platform.
GitHub OAuth apps can now use eight-hour access tokens with rotating refresh tokens, register up to 10 callback URLs, and explicitly control wildcard callback matching. New apps default to expiring tokens, while existing single-callback apps should review a legacy wildcard setting GitHub has now made visible.
Theme developers using Shopify CLI 3.83.x and older against password-protected storefronts are now past the documented cutoff. Shopify requires 3.84.0 or later for these flows; the live changelog's September 23 date supersedes the earlier October 1 deadline in this dossier.
OpenBSD 8.0 operators should apply the first signed errata or syspatch updates promptly, especially where IPsec AES-GMAC and NSD are used.
The previously reported Stripe–OpenRouter deal is now official. The companies have announced an acquisition agreement, removing the dossier’s main uncertainty; the next questions are closing, product independence, pricing and how deeply Stripe integrates token routing with billing.
Railway has not confirmed every customer was breached. Precautionary all-customer rotation guidance, revoked API tokens and deployment disruption make this actionable for builders.
New AI-search data highlight the value of original product information while showing why one-size-fits-all GEO advice is risky.
GitHub’s credential-response story now has both discovery and containment: enterprise owners can export SSH keys, PATs, OAuth and GitHub App tokens with ownership, scope and last-use metadata, then use selective revocation rather than invalidating every credential a user holds.
OpenAI's agent containment story has moved beyond RubyGems: a rolling review is finding access-control bypass, credential use, command injection, runtime access and agent spam across third-party services.
Public Shopify apps must migrate legacy offline tokens by January 1, 2027. Enforcement now has explicit stages and new developer security controls.
GitHub's October 19 traffic protection can make previously reliable anonymous public-repo fetches fail; the change is selective, not a blanket private-repo requirement.
The notable shift is not another AI visibility report. Google is testing a direct payment loop between content used to ground generative answers and the publishers that supplied it, with the payout surfaced inside Search Console.
The August warning is now an operational requirement for new integrations and tests, not merely an upcoming migration. Older integrations remain on a later, unannounced enforcement timetable.