Find published research by company, product, platform or technology.
Showing 101–120 of 285 dossiers
TRACE targets a gap between audit promises and what an AI agent actually did at runtime. Its v0.2 developer preview can bind model, policy, data and tool-use claims to confidential-computing attestation, but it is still pre-ratification and explicitly not ready to treat as a production compliance guarantee.
Ada has added code tools that run a restricted Python subset inside agent conversations. They can transform API responses, perform deterministic calculations and call allowlisted domains, while MCP-authored changes can be staged and reviewed before promotion.
Google Cloud’s Developer Device Platform is now in public preview with remote physical-device streaming, parallel emulator testing, smart sharding and an agent skill that can drive multi-step journeys, inspect visual issues and feed fixes back into coding agents. It is billed per active device minute and remains a pre-GA service.
Codex 0.149.0 includes the async-message tool, delivery metadata and removal of the client-side feature gate that BTN previously tracked only on main. Parallel human-agent work is now in a stable client, but late replies can still race with decisions and model capability metadata remains the final exposure gate.
GitHub Apps no longer need repository-administration permission just to create repositories. New fine-grained installation controls and token-rotation support reduce the privilege required for integration automation.
This is an identity-system failure rather than an application bug: a vulnerable Keycloak deployment can let an attacker turn the legitimate “forgot password” flow into full account takeover without credentials or victim interaction. Upgrade is the proper fix; disabling Forgot Password in every realm is Red Hat’s temporary mitigation.
GitHub OAuth apps can now use eight-hour access tokens with rotating refresh tokens, register up to 10 callback URLs, and explicitly control wildcard callback matching. New apps default to expiring tokens, while existing single-callback apps should review a legacy wildcard setting GitHub has now made visible.
The change creates an authentication compatibility boundary for server-to-server Gemini integrations: an architecture that works in an existing project may not be reproducible with a newly introduced service account, and Google has not published an end date for the restriction.
The useful finding is not that BRIN is bad: it is that a table can still report strong column correlation while update churn has destroyed the physical range locality BRIN actually depends on. DeepSQL published the full Docker/SQL harness so teams can reproduce the failure mode on their own workloads.
This is not one headline vulnerability fix. Gemini CLI 0.60 is a coordinated hardening pass across the plumbing that lets extensions, sandboxes, filesystem paths and MCP authentication influence an agent’s execution environment.
A 15-CVE pgAdmin update also changes how server-mode password commands are migrated, with a potentially irreversible first-start consequence.
Private ingress joins existing private egress for Scaleway Serverless Containers. The new option can isolate services inside a VPC, but private DNS, TLS, authentication, cold-start and network-scope constraints still matter.
Fitbit API integrations have less than a month to migrate. The replacement changes authentication and API surface, while Google is still restricting onboarding for new Health API projects.
The new program creates a specialized Gmail deliverability path for verified political senders, but it is not an inbox guarantee: recipients can still mark mail as spam, block senders or unsubscribe, and non-compliant domains can be suspended or removed.
Edge Scripts no longer have to sit behind bunny.net’s automatic cache. New pre-cache hooks can execute before cache lookup, while a separate Cache API lets scripts read, write and delete regional cache entries under application control.
A six-month real-world comparison shows AI code-review agents and specialised fuzzers find substantially different V8 vulnerabilities. Replacing fuzzing with agents would leave gaps, and cost per bug remains unknown.
Groq 3 LPX is moving from architecture announcement to manufactured infrastructure. Artificial Analysis measured about 3,400 output tokens/s at both 10K and 100K context on an NVIDIA-hosted private endpoint, but the single-concurrency benchmark does not yet establish public-cloud price, multi-tenant throughput or end-to-end agent speed.
Notion Workers are now metered inside the same credits system as Custom Agents. The important builder shift is that schedules, webhook fan-out and agent tool-call counts now directly affect cost.
New RevenueCat growth tools bring web funnels, AI paywalls and early payouts into one subscription platform, with important eligibility and fee caveats.
OpenAI's new API credit grants can lower the cost of prototyping apps and agents, but eligibility, expiration, API limits and excluded Codex usage matter.