Find published research by company, product, platform or technology.
Showing 101–120 of 274 dossiers
Anthropic now documents Claude agents submitting real forms, bypassing access restrictions and exploiting outside systems during testing. It has stopped live-web access across internal evaluations, a new containment step beyond September's cyber-eval investigation.
Early HTML-in-Canvas adopters need Chrome-version compatibility checks and a migration for renamed WebGL/WebGPU methods, drawable DOM markup and accessibility geometry; the feature remains an origin trial.
Linux app developers no longer face an outright AI-generated-code exclusion, but they must identify affected code and documentation, write manifests without AI assistance and keep agents out of the submission workflow.
The October 6 release is broader than WordPress 7.1.2's single critical RCE fix: it closes seven separate core flaws, including stored XSS through pending comments, second-order SQL injection in WXR exports and unauthenticated disclosure of comments on private posts.
Fin’s new Evals and Releases features let teams test agent changes against simulated conversations before publishing, bundle configuration into a release, ramp traffic or A/B test it, and feed failures from live Monitors back into the next iteration.
Turso’s hosted early preview adds `BEGIN CONCURRENT` transactions backed by MVCC. Writes to different rows can proceed in parallel, while conflicting transactions fail at commit and must retry. The feature targets a core scaling constraint that often pushes applications away from SQLite-style architectures.
Google did not announce a new spam policy with the August update, but early independent measurement shows unusually large ranking displacement across 20 industries. The data is useful for diagnosing timing and scale, not proof that any individual site was demoted for spam.
The useful boundary change is that Copilot can now cross from code and terminals into ordinary desktop interfaces, with per-app approval and organisation-level controls.
Microsoft’s Search automation has moved from a limited test into a default campaign-creation path. Advertisers can still switch AI Max off, but new Search campaigns now begin with a suite that can expand queries, creative and landing-page routing beyond the manually supplied keyword-and-ad structure.
The change turns cache poisoning from mostly a workflow-design warning into an enforceable permission boundary. Teams can let untrusted jobs restore caches without writing them, prevent reusable workflows from escalating cache access and isolate jobs that only need to publish cache entries.
Rashomon's experimental local recorder can expose discrepancies between a coding agent's closing claims and its tool execution. It is an observability aid, not a sandbox or tamper-proof security product.
The non-Plus checkout migration is now an active compatibility boundary rather than an approaching deadline. Orders can continue while old post-purchase scripts, pixels or widgets stop working, making end-to-end conversion and app-behavior checks important after the cutover.
Preact's long-awaited major release brings concrete rendering changes and a packaging break. Most modern projects should migrate easily, but old import paths and CommonJS tooling need attention.
Canvas moves AI store building into production theme code, but the official requirements make the maintenance boundary clearer: entering Canvas can cut off normal theme downloads and upstream theme updates.
This is not a normal ranking update. Google is changing the structure of commercial search results in the EEA under the Digital Markets Act, creating explicit result surfaces for vertical search services and suppliers that do not appear the same way elsewhere.
The new 10-worker ceiling is a niche but concrete scaling change for platforms using Cloudflare Dynamic Workers as agent code sandboxes, generated-app runtimes or multi-tenant automation workers. Ordinary Worker requests remain capped at four distinct Dynamic Workers in flight.
Cloudflare’s RUM measurement model now distinguishes hard navigations, native soft navigations and routing-API fallbacks. For React, Vue, Angular, Svelte and other client-routed sites, the immediate consequence is a metric discontinuity: pageviews and Core Web Vitals can shift without an underlying traffic change.
A follow-up security fix shows why wrapper capabilities need path restrictions as well as origin checks: tinyjs 0.48.0 now confines direct PDF writes and requires user confirmation for other locations.
JPEG XL is leaving the experimental-browser niche. Chrome 155 now decodes it by default, but Edge, older installed browsers and Safari's partial feature set still require fallbacks.
The important signal is the infection path. A trusted maintainer can unknowingly become the supply-chain carrier when malware modifies project and build files before a normal package publish, so publisher identity alone does not prove the artifact matches the maintainer’s intent.