Find published research by company, product, platform or technology.
Showing 161–180 of 420 dossiers
MHS is an attempt to make microscopes, liquid handlers, robotic arms and other programmable hardware look like a consistent tool surface to AI agents. It is still a research preview, but the interoperability layer is already being tested with research institutions and hardware vendors.
The useful lesson is architectural rather than vendor-specific: coding agents inherit execution paths from ordinary developer tooling. If an agent shells out to Git without sanitising repository-local configuration, a hidden `.git/config` can become a host-level command channel that bypasses the controls users think govern the model.
PingCAP reports an internal-systems breach affecting TiDB Cloud account and SQL-editor records; customers should rotate management keys and credentials shared in support tickets.
Workers KV Instant is built for hot-path flags, not general storage: Cloudflare quotes 1.62ms p99 reads, $0.20 per million reads, $0.10 per write and $100 per MB each month. Private beta limits are strict.
The live DeepSeek changelog and rate card still show distinct V4 Pro service after the previously announced September 14 reroute. That changes cost and model-selection assumptions.
Stripe expands Global Payouts and EU stablecoin issuing; its subsequent $1B internal migration provides practical lessons about payout validation, reconciliation and route-specific eligibility.
OpenAI’s August 21 control moves processing-region choice into request routing: a single Global project can send eligible calls to regional base URLs. That simplifies multi-region SaaS architecture, but builders still need to enforce residency policy in code and account for support, retention and pricing constraints.
GLiNER2.5-Decide attacks the same bounded-decision layer as Jev and CLM from a much smaller encoder architecture. Its strongest benchmark claims are vendor-produced, but CPU deployment and constrained joint decoding make it a materially different option for software-facing AI decisions.
Public Shopify apps must migrate legacy offline tokens by January 1, 2027. Enforcement now has explicit stages and new developer security controls.
The Agent Host’s environment boundary has moved from local Dev Containers to remote development hosts, making persistent coding-agent sessions more portable across real remote projects.
The CLI itself is not being deprecated. The risk is narrower and operational: stale Linux repository keyrings can stop package installs or updates from verifying after the old signing key expires.
PQ GeoKey Manager uses hybrid cryptography, regional root keys and fail-closed key unwrapping. General availability is planned for Q1 2027; CDN integration and independent assurance remain outstanding.
Hugging Face has released 207 Apache-2.0 WebGPU kernels, a JavaScript loader and Fleet, a browser benchmarking service. The package makes kernel contracts and correctness evidence inspectable, but performance remains device- and workload-dependent.
Ada has added code tools that run a restricted Python subset inside agent conversations. They can transform API responses, perform deterministic calculations and call allowlisted domains, while MCP-authored changes can be staged and reviewed before promotion.
The October 15 Forgejo 17.0 release strengthens self-hosted Git and CI workflows, but webhook receivers need a migration because the new workflow-run events change headers and payload semantics. The release is non-LTS.
The new request-level controls make email measurement a per-send decision: an application can keep one SES configuration set while disabling open or click tracking for recipients who should not be measured. The override wins over the configuration-set default and adds no separate feature charge.
Mozilla reports more than seven times as many Firefox security fixes as a year earlier, while adopting weekly releases, confidential regression tests and a proposed strategy to avoid overlapping exploit-chain patch gaps.
Google Play’s 2026 target-API cutoff has two separate consequences: most new submissions and updates need API 36, while existing apps below API 35 can lose distribution to new users on newer Android devices. Developers who need more time can request an extension to November 1.
The most broadly relevant issue lets attackers potentially drive TLS retransmission state into unbounded behavior or acknowledge packets that cannot be outstanding. Several additional fixes narrow local or configuration-dependent Windows attack paths.
After Chrome 153's signed-JSON migration, Chrome 154 brings Android and third-party origin-trial support and changes the issuance request's Sec-Fetch-Dest value. Chrome 156 will reject provider tokens whose email claim does not exactly match the submitted address.