Find published research by company, product, platform or technology.
Showing 101–120 of 558 dossiers
The pilot attacks a persistent evaluation trade-off: labs do not want to reveal frontier-model internals, while evaluators do not want benchmark prompts leaking back to the model provider. DeepMind says a Singapore AI Safety Institute pilot kept both sides’ sensitive assets hidden during execution.
Estuary’s new runtime is less about an AI label than a data-correctness problem: the same pipeline is meant to move from millisecond streams to large backfills without exposing downstream systems to partial transactions or requiring separate batch reconciliation.
Supabase has implemented MCP Enterprise-Managed Authorization using identity-provider assertions, short-lived tokens and existing Supabase role boundaries. It gives organizations a central on/off switch for approved AI clients while keeping access scoped to the individual employee rather than sharing a powerful organization token.
Private SaaS teams now have a fresher efficiency baseline: median ARR per employee rose to $141,125, and bootstrapped businesses lead equity-backed peers on the metric across company sizes. The same survey family shows bootstrapped $3M–$20M SaaS companies growing more slowly but generally operating with stronger cost discipline.
Edge Scripts no longer have to sit behind bunny.net’s automatic cache. New pre-cache hooks can execute before cache lookup, while a separate Cache API lets scripts read, write and delete regional cache entries under application control.
The study moves the AI-search traffic debate beyond observational correlations: participants were randomly assigned to current Google Search, a version with AI features hidden, or AI Mode-only search during ordinary browsing. It is still a preprint and does not establish effects for every query or publisher.
Email open tracking is becoming a consent-controlled data source rather than a default analytics primitive. Klaviyo’s new controls can remove opens from reporting, attribution, segments and flow triggers for recipients who should not be tracked.
Supabase’s self-hosted stack now routes through Envoy by default, bringing new API-key support and hardened gateway defaults while breaking some Kong-specific assumptions.
WordPress 7.1 is now generally available. Its always-iframed post editor removes a long-standing split between iframe and non-iframe contexts, while browser-side image processing moves more media work out of PHP and into WebAssembly.
Cloudflare’s new MCP controls turn TLS-inspected Gateway traffic into an inventory and policy surface for remote MCP use, while explicitly leaving local stdio, off-network and uninspected traffic outside visibility.
Computer Use is now GA in both Gemini APIs, but it is an action-planning tool, not a hosted remote desktop: clients execute clicks and keystrokes and must handle safety decisions.
A graph, an HTML Preview and a trusted virtual-keyboard message listener combined to bypass ChatGPT's iframe boundary. The fix is reported shipped, but the incident offers a practical warning to anyone embedding untrusted interactive content.
The live census still finds flat/platform pricing ahead of per-seat, but its latest 31% share, 1,855 priced-company denominator and 96% sampled extraction audit supersede the October 2 dossier's figures.
Omacom expands in-kind AI and compute patronage and reports nearly 1,500 Greptile-reviewed PRs. Pledges are not audited cash revenue.
Stalwart 1.0.1 fixes local credential-file permissions and a tenant isolation bug, but changes Prometheus/OTLP metrics and leaves some migration WebUI cache pitfalls.
ChatGPT Ads' new default-on AI creative system can adapt ad copy and landing-page destinations using conversation context. Advertisers should audit account and campaign settings and ensure pages remain accurate.
Retailers and commerce-tool developers can now query first-party UCP shopping funnels rather than infer agentic checkout performance from traffic alone, but the alpha API needs careful query design.
Old third-party JavaScript includes can become a live supply-chain attack when their domains expire. DeadTag shows why removing abandoned tags and monitoring what scripts load is operational security, not housekeeping.
The new $0-subscription tier no longer lists starter credits, while three simultaneous requests are now permitted. Builders should check prepaid balance, model prices and queues before relying on the service.
Cloudflare saw roughly 22,000 weak-chain TLS handshakes, about 160 unusual forged certificates and 50 million skewed challenge-page probes. The data indicate continuing exposure, not 22,000 successful attacks.