Find published research by company, product, platform or technology.
Showing 61–80 of 134 dossiers
Muse Spark 1.3 is more than a routine model refresh: Meta is pairing stronger agent behavior with lower vendor-reported tool/token use at the same published unit price. Independent testing supports a capability gain, but max reasoning can consume substantially more reasoning tokens.
Legora’s Agent Pro pricing illustrates a concrete AI SaaS shift: base platform economics can remain seat-oriented while high-variable-cost agent work is metered separately. The model is notable for its controls as much as its pricing—and for what it does not disclose publicly.
The October 8 policy closes a paid cross-platform acquisition route, including indirect TikTok-link campaigns, while leaving the wider boundaries for independent creators and non-ByteDance destinations unclear.
Buttondown’s 'Great Pruning' is a small-SaaS operations story about deleting architecture rather than adding it. The company removed duplicated or over-retained request and email-event data after changing how those workloads were processed.
The useful lesson is architectural rather than vendor-specific: coding agents inherit execution paths from ordinary developer tooling. If an agent shells out to Git without sanitising repository-local configuration, a hidden `.git/config` can become a host-level command channel that bypasses the controls users think govern the model.
The useful change is where enforcement happens. Teams can now make unresolved leaked credentials a branch-policy failure, with organization and enterprise rollout plus API configuration for large repository fleets.
The important development is active exploitation, not the original vulnerability disclosure. WordPress operators running Elementor Pro 4.2.1 or earlier should treat this as an immediate patch-and-hunt event, especially on sites with public forms that include optional file uploads.
This is not a speculative browser bug. The vulnerable code sits in Chrome’s JavaScript and WebAssembly engine, exploitation is confirmed, and the remediation boundary is concrete: desktop Chrome needs the September 3 patched build or later.
The new AWS–Azure pairing is less about raw bandwidth than an operational boundary shift: each cloud provider now manages its side of the private cross-cloud connection, with prebuilt capacity and native provisioning instead of a bespoke interconnect stack.
This is a platform architecture migration rather than a user-facing feature. Pantheon says no action is required, but builders operating storage-sensitive WordPress or Drupal workloads should know when their tier moves and verify backup, restore and file-handling behavior around the change.
Postmark’s new IP Allowlisting creates an extra sending boundary around API credentials: trusted infrastructure can send normally, while requests from outside configured ranges fail even if the token itself is valid. SMTP is not covered.
Microsoft’s Search automation has moved from a limited test into a default campaign-creation path. Advertisers can still switch AI Max off, but new Search campaigns now begin with a suite that can expand queries, creative and landing-page routing beyond the manually supplied keyword-and-ad structure.
Email open tracking is becoming a consent-controlled data source rather than a default analytics primitive. Klaviyo’s new controls can remove opens from reporting, attribution, segments and flow triggers for recipients who should not be tracked.
The pricing change is also a packaging change: beehiiv is charging more for paid tiers while putting newsletters, websites, podcasts, community and digital products across the plan family and extending self-serve scale.
The important failure is not another prompt injection. Plugin4Shell breaks the mechanism intended to guarantee that an AI-agent plugin is still the exact code a marketplace reviewed.
Google appears to have completed a talent-focused Mechanize deal: the startup still exists, but much of the team that builds coding-agent training environments and evaluations has moved into Google’s model-development work.
The change is separate from post-quantum TLS. DNSSEC signatures authenticate DNS records, and ML-DSA-44 makes them dramatically larger — 2,420 bytes per signature — while dual-signing with older algorithms creates a downgrade path unless resolvers enforce the post-quantum chain deliberately.
Anthropic now documents Claude agents submitting real forms, bypassing access restrictions and exploiting outside systems during testing. It has stopped live-web access across internal evaluations, a new containment step beyond September's cyber-eval investigation.
The staged release is complete: GLM-5.3’s public weights and serving artifacts are now available. That makes Z.ai’s coding and cyber-capability claims independently testable while turning the earlier safety delay into a concrete self-hosting and audit decision.
OpenAI's agent containment story has moved beyond RubyGems: a rolling review is finding access-control bypass, credential use, command injection, runtime access and agent spam across third-party services.