Find published research by company, product, platform or technology.
Showing 21–40 of 181 dossiers
This was not a Firecracker escape or access to a live victim disk. It was a storage-isolation failure underneath the sandbox: researchers recovered foreign directory structures, database pages and complete SQLite databases from reused blocks, and Cloudflare had to fix allocation plus retire existing disks and cached snapshots.
The useful change is containment rather than another browser-agent feature. Teams can let an agent operate a real browser while constraining its HTTP and HTTPS reach to the site and dependencies the task actually needs, reducing the blast radius of prompt injection, bad tool decisions or untrusted page content.
The technical migration is unchanged, but Reddit's documentation has proven unusually volatile. Integrations should now treat September 21 as the current objective/form readiness date and December 8 as the current published cutoff for HOUR reports longer than seven days—while continuing to recheck the live docs before each deadline.
Cloudflare has inverted a long-standing Workers assumption: Node.js compatibility is now on by default for current compatibility dates. That reduces setup friction for many npm packages, but it also means developers need to understand compatibility-date boundaries, partial APIs and explicit opt-out flags.
Token pricing makes hosted open-model spend easier to model than GPU time, but it is not uniformly time-invariant: DeepSeek V4 Flash and Pro currently double in price from 12:00–18:00 UTC Monday–Friday, while Free, Pro, Max and Team allow 1, 3, 10 and 10 concurrent requests respectively.
The non-Plus checkout migration is now an active compatibility boundary rather than an approaching deadline. Orders can continue while old post-purchase scripts, pixels or widgets stop working, making end-to-end conversion and app-behavior checks important after the cutover.
For some queries, Google is no longer waiting for a user to open a longer AI Overview. The system can expand it automatically, creating a larger zero-click answer surface and moving traditional results further down the page.
Microsoft’s Search automation has moved from a limited test into a default campaign-creation path. Advertisers can still switch AI Max off, but new Search campaigns now begin with a suite that can expand queries, creative and landing-page routing beyond the manually supplied keyword-and-ad structure.
Blocking OAI-SearchBot is not a complete removal signal for ChatGPT Atlas. OpenAI says a disallowed page can still appear as a link and title when the URL is learned elsewhere and judged relevant; publishers that want to suppress that result need a crawlable noindex directive, while GPTBot remains the separate training control.
The August 20 tagging overhaul collapses Google’s lightweight tag and GTM into one platform, changing how marketers manage measurement code without requiring existing Google tags to behave differently on-page.
An October 14 study tests package-manager integrity against a malicious registry. Composer, npm and other ecosystems differ sharply in what they verify automatically.
Developers can now profile a deployed Worker or a specific Durable Object without reproducing production traffic locally. Captures require an active isolate and measure allocations during the capture window, not retained memory.
The new program creates a specialized Gmail deliverability path for verified political senders, but it is not an inbox guarantee: recipients can still mark mail as spam, block senders or unsubscribe, and non-compliant domains can be suspended or removed.
The limits themselves were already documented; the material change is enforcement. Free-tier D1 workloads that previously relied on soft overage behavior now need query-cost awareness, indexes and a plan for temporary failures or paid migration.
Google’s September Search changes now form a broader migration story: legacy campaign-level Broad Match and standalone Automatically Created Assets settings will be converted into AI Max, while language targeting stops affecting Search delivery and related API mutations begin failing.
Google has moved the Smart Campaign API creation cutoff to September 23. New create operations will fail, while existing campaigns can still be updated and served; Google points developers toward Performance Max, Search or Demand Gen for new automation.
Retailers can now submit warranty duration as structured product-feed data, but the new Google field does not replace Quebec's mandatory near-price disclosures or the underlying free repair guarantee.
Google reversed its earlier ad-free approach to Personal Intelligence in AI Mode. Connected-app-derived insights may influence ads, with testing scope and advertiser controls still unclear.
Firefox Enterprise 158 combines a Gecko-based browser with an on-premises management console, domain-level DLP and SIEM export. Initial sales focus on four European countries; ESR support and public pricing are not yet available.
The new Turso 0.8 results add a concrete performance datapoint to the earlier MVCC preview, but benchmark workloads, transaction conflicts and production durability still require independent verification.