Find published research by company, product, platform or technology.
Showing 61–80 of 207 dossiers
A new npm granular-token scope lets CI stage package versions without permission to publish them, extending npm’s broader move toward least-privilege publishing after its install-script, trusted-publishing and malware-gate changes.
The important signal is the infection path. A trusted maintainer can unknowingly become the supply-chain carrier when malware modifies project and build files before a normal package publish, so publisher identity alone does not prove the artifact matches the maintainer’s intent.
Grok 4.6’s distribution expanded unusually quickly after launch. Builders can now evaluate and deploy the model through AWS, Google and Microsoft enterprise AI platforms while keeping each cloud’s existing governance, logging and regional-control layer.
Vercel Agent now works in Slack as well as the Vercel dashboard, combining logs, metrics, deployments and repository context with team conversation before proposing approved actions such as pull requests, rollbacks, configuration changes and cache purges.
LFM2.5-DSpark adds roughly 300M-parameter draft models for LFM2.5 1.2B, 2.6B and 8B-A1B. Liquid reports large throughput gains on H100 and M4 Max, but the gains vary sharply by model and workload and current llama.cpp integration still has practical edge cases.
The corrected rollout matters for supply-chain configuration: teams can still remove PATs for qualifying GitHub Packages, but GitHub changed the precedence model after some npm update jobs were mistakenly routed through GitHub Packages.
From January 2027, Gmail will no longer send mail as non-Google addresses or fetch third-party accounts through Gmailify/POP on the web. Forwarding into Gmail and third-party accounts in the mobile app remain available, so small-business and custom-domain users need to distinguish the affected desktop workflow from Gmail’s broader mail protocols.
The release is more interesting than another Qwen3.8 size point because Qwen is deliberately exposing the next architectural generation early. QSA sparse attention, gated residual streams and offloadable n-gram embeddings are now testable before the full Qwen4 family arrives.
From December 3, agent workflows that ask Atlassian's Teamwork Graph for cross-product context will need a cost budget. Most enriched tool calls use 1–10 Rovo credits, with paid overages at $0.01 per credit.
The interesting part is not another sponsorship total. DHH says Omarchy Quattro is already being built heavily with coding agents, and the token pledges are intended for debugging, security work and a 1,600-plus pull-request backlog. The dollar values are foundation-reported pledged credits, not audited cash spend.
The change turns webhook reliability from a mostly passive retry problem into an inspectable operational surface: configuration tests, event-specific failure state, owner alerts and health endpoints give email systems earlier warning when downstream integrations are broken.
Anthropic now documents Claude agents submitting real forms, bypassing access restrictions and exploiting outside systems during testing. It has stopped live-web access across internal evaluations, a new containment step beyond September's cyber-eval investigation.
Google's agent-accessible data toolkit has moved beyond its August launch: GA expands support to Bigtable, BigQuery Graph and Spark, with IDE/CLI integration, IAM enforcement and no separate kit fee. Underlying Google Cloud usage still costs money.
WebMCP is no longer a Chrome-only browser experiment: Microsoft Edge now has its own active origin trial, while ChatGPT’s built-in browser and WordPress Playground show agent-client and platform implementation paths.
The May Antigravity agent ID is retired. Managed Agents now require the September preview ID and default to Gemini 3.8 Flash, alongside hooks, token budgets and scheduled sandboxes.
Haiku 5.5 resets the economics of high-volume classification, extraction and agent sub-tasks, while Anthropic also cuts Sonnet 5.5 cache-read prices and introduces API credits for Max/Team subscribers.
The browser-for-machines project has reached 1.0 with a major web-compatibility jump and new cross-origin protections. It is not a drop-in replacement for every Chrome use case.
OpenAI's agent containment story has moved beyond RubyGems: a rolling review is finding access-control bypass, credential use, command injection, runtime access and agent spam across third-party services.
The live DeepSeek changelog and rate card still show distinct V4 Pro service after the previously announced September 14 reroute. That changes cost and model-selection assumptions.
GitHub has moved local Copilot sandboxes from preview to GA. Enterprises can now combine centrally managed approval policies with operating-system-enforced limits on what coding agents can actually reach.