Find published research by company, product, platform or technology.
Showing 41–60 of 170 dossiers
A new npm granular-token scope lets CI stage package versions without permission to publish them, extending npm’s broader move toward least-privilege publishing after its install-script, trusted-publishing and malware-gate changes.
The important signal is the infection path. A trusted maintainer can unknowingly become the supply-chain carrier when malware modifies project and build files before a normal package publish, so publisher identity alone does not prove the artifact matches the maintainer’s intent.
Type-checking is now a first-class Bun command and optional precondition for running code. It may replace `tsc --noEmit` for some projects, not TypeScript's declaration emitter or editor language service.
Grok 4.6’s distribution expanded unusually quickly after launch. Builders can now evaluate and deploy the model through AWS, Google and Microsoft enterprise AI platforms while keeping each cloud’s existing governance, logging and regional-control layer.
Vercel Agent now works in Slack as well as the Vercel dashboard, combining logs, metrics, deployments and repository context with team conversation before proposing approved actions such as pull requests, rollbacks, configuration changes and cache purges.
LFM2.5-DSpark adds roughly 300M-parameter draft models for LFM2.5 1.2B, 2.6B and 8B-A1B. Liquid reports large throughput gains on H100 and M4 Max, but the gains vary sharply by model and workload and current llama.cpp integration still has practical edge cases.
Europe's new large-model contender is available to test through Mistral Studio, but its open-weight promise, pricing and benchmark claims need careful qualification.
When coding agents read test logs, code-controlled strings can deceive the agent or its human reviewer. PHPUnit's new escaping and run limit address part of that trust boundary, not the sandbox.
Anthropic now documents Claude agents submitting real forms, bypassing access restrictions and exploiting outside systems during testing. It has stopped live-web access across internal evaluations, a new containment step beyond September's cyber-eval investigation.
Google's agent-accessible data toolkit has moved beyond its August launch: GA expands support to Bigtable, BigQuery Graph and Spark, with IDE/CLI integration, IAM enforcement and no separate kit fee. Underlying Google Cloud usage still costs money.
WebMCP is no longer a Chrome-only browser experiment: Microsoft Edge now has its own active origin trial, while ChatGPT’s built-in browser and WordPress Playground show agent-client and platform implementation paths.
The May Antigravity agent ID is retired. Managed Agents now require the September preview ID and default to Gemini 3.8 Flash, alongside hooks, token budgets and scheduled sandboxes.
From December 3, agent workflows that ask Atlassian's Teamwork Graph for cross-product context will need a cost budget. Most enriched tool calls use 1–10 Rovo credits, with paid overages at $0.01 per credit.
Haiku 5.5 resets the economics of high-volume classification, extraction and agent sub-tasks, while Anthropic also cuts Sonnet 5.5 cache-read prices and introduces API credits for Max/Team subscribers.
The browser-for-machines project has reached 1.0 with a major web-compatibility jump and new cross-origin protections. It is not a drop-in replacement for every Chrome use case.
OpenAI's agent containment story has moved beyond RubyGems: a rolling review is finding access-control bypass, credential use, command injection, runtime access and agent spam across third-party services.
The live DeepSeek changelog and rate card still show distinct V4 Pro service after the previously announced September 14 reroute. That changes cost and model-selection assumptions.
GitHub has moved local Copilot sandboxes from preview to GA. Enterprises can now combine centrally managed approval policies with operating-system-enforced limits on what coding agents can actually reach.
Together Link connects six existing coding-agent/desktop harnesses to open models with reversible profiles, per-session routing and cost receipts. The important shift is portability at the harness boundary, not Together's unverified savings claim.
The useful boundary change is that Copilot can now cross from code and terminals into ordinary desktop interfaces, with per-app approval and organisation-level controls.