Find published research by company, product, platform or technology.
Showing 21–40 of 89 dossiers
Anthropic now documents Claude agents submitting real forms, bypassing access restrictions and exploiting outside systems during testing. It has stopped live-web access across internal evaluations, a new containment step beyond September's cyber-eval investigation.
The change creates an authentication compatibility boundary for server-to-server Gemini integrations: an architecture that works in an existing project may not be reproducible with a newly introduced service account, and Google has not published an end date for the restriction.
LiteLLM 1.107.0 remains a known compromised release. Its October 30 security review now sets out why signing failed to protect users and which fixes are complete versus only promised.
The self-hosted deployment platform's November 2 release changes how teams delegate infrastructure control. Existing integrations using write-only tokens for deletions may fail until explicitly reauthorised.
The September 17 GA changes the economics of Neon's backend: free allowances remain, but object storage, function execution and model calls are now metered on paid plans. November 2 adds an OAuth Provider plugin, still labelled beta.
Developers can now train and evaluate adapters through custom code while Together runs the GPU-heavy operations. The flexibility comes with B200-only support, a $100 credit threshold and ongoing charges for idle ready resources.
AMD is not just buying another AI software company. It is buying a frontier model lab so the workloads behind spatial intelligence, robotics and simulation can help shape the compute stack AMD builds next.
Self-Hosted Machines changes the architecture of Cursor’s Cloud Agents more than another model option would. Teams can keep code, build outputs, secrets and terminal/browser actions on infrastructure they control, but the planning/inference loop remains a Cursor service and enterprise teams become responsible for worker images, scaling, secrets and production validation.
The deadline is no longer theoretical: browsers, Git HTTPS backends and API clients that still depend on SHA-1-era TLS algorithms can now lose connectivity to GitHub.com.
GitHub Agentic Workflows 1.2.x previews durable handoffs, hardened egress and queue recovery after GA; teams must distinguish pre-releases from stable deployment guarantees.
Node 26 is now production LTS. Teams using floating LTS selectors should test which major their CI, containers and native modules actually run.
PingCAP reports an internal-systems breach affecting TiDB Cloud account and SQL-editor records; customers should rotate management keys and credentials shared in support tickets.
The architectural shift is from application-wide container configuration toward individually managed stateful compute. A Durable Object can now start its own image and size, keep an independent lifecycle and restore filesystem state without treating every instance as part of one rollout.
Docker’s new agent stack combines pay-as-you-go microVM sandboxes with an OCI-based Kit format for declaring what an agent can use. Cloud sessions cost from $0.07 to $1.12 an hour, and Docker says it plans to take the Kit specification toward CNCF neutral governance.
Postmark’s new IP Allowlisting creates an extra sending boundary around API credentials: trusted infrastructure can send normally, while requests from outside configured ranges fail even if the token itself is valid. SMTP is not covered.
The endpoint names are staying the same, but the trust chain is not. Teams that pin Sentry certificates or still ship very old Android/Java runtimes need to remove or update those assumptions before Sentry publishes its exact February cutover date.
TRACE targets a gap between audit promises and what an AI agent actually did at runtime. Its v0.2 developer preview can bind model, policy, data and tool-use claims to confidential-computing attestation, but it is still pre-ratification and explicitly not ready to treat as a production compliance guarantee.
Playground’s legacy-runtime work turns the browser sandbox into a version-spanning compatibility lab. Maintainers can inspect old WordPress behavior without keeping obsolete PHP stacks alive, although the browser runtime is not a faithful recreation of every historical host.
GitHub OAuth apps can now use eight-hour access tokens with rotating refresh tokens, register up to 10 callback URLs, and explicitly control wildcard callback matching. New apps default to expiring tokens, while existing single-callback apps should review a legacy wildcard setting GitHub has now made visible.
WebKit's Safari MCP server is available in stable Safari 27.0 as well as Technology Preview. It runs locally, but captured page data passes to the connected agent; remote automation must be enabled explicitly.