Find published research by company, product, platform or technology.
Showing 1–20 of 63 dossiers
Google did not announce a new spam policy with the August update, but early independent measurement shows unusually large ranking displacement across 20 industries. The data is useful for diagnosing timing and scale, not proof that any individual site was demoted for spam.
Google Analytics hostname allowlists reduce some ghost-traffic cleanup, but server-side Measurement Protocol events bypass the filter. Teams must distinguish browser collection from Measurement Protocol and test empty-hostname events.
The new program creates a specialized Gmail deliverability path for verified political senders, but it is not an inbox guarantee: recipients can still mark mail as spam, block senders or unsubscribe, and non-compliant domains can be suspended or removed.
GitHub has moved local Copilot sandboxes from preview to GA. Enterprises can now combine centrally managed approval policies with operating-system-enforced limits on what coding agents can actually reach.
Woodpecker's agent labels were self-reported and unsuitable for authorization. Version 3.19 adds server-held filters and patches a clone-step environment-variable leak; administrators should verify their worker policies.
Connection Allowlists turn outbound browser networking into an explicit allowlist for Fetch and other web-platform APIs. The control is opt-in and currently Chromium-only, and strict policies can break legitimate dependencies such as FedCM identity-provider requests if teams omit required endpoints.
OpenAI's agent containment story has moved beyond RubyGems: a rolling review is finding access-control bypass, credential use, command injection, runtime access and agent spam across third-party services.
Google is creating a geographic split in one of Search's most consequential spam controls. Publishers can face a manual action globally, but EEA users will see the affected section ranked on its own merits rather than directly demoted by that action.
The two August 28 changes move a common production-agent problem out of bespoke application code: builders can derive memory boundaries from authenticated JWT claims, enforce them with Cedar policy, and organize the stored memory using runtime tenant dimensions.
Cloud Run instances sit between autoscaling serverless services and a small VM. They run one individually addressable container continuously, can be stopped and restarted, and use shared CPU economics; Google’s launch example prices 1 vCPU plus 1 GiB running for 30 days at $5.70.
From September and October, Copilot Business and Enterprise seat access becomes more tightly coupled to upfront payment. A separate September 28 policy migration enables a unified Copilot experience by default, retains github.com chat data for the life of the account and changes code review’s default effort from Lite to Balanced.
Agent Plugins 1.0 now has documented support across VS Code, Cursor, GitHub Copilot, ChatGPT/Codex, Kiro and several open-source agents. That makes the format materially more useful for cross-client distribution, but portable components remain limited to Agent Skills and MCP servers while permissions, hooks, commands and host UX stay client-specific.
Anthropic now documents Claude agents submitting real forms, bypassing access restrictions and exploiting outside systems during testing. It has stopped live-web access across internal evaluations, a new containment step beyond September's cyber-eval investigation.
Agent checkout builders using UCP 2026-08-25 can now negotiate consent options, propagate customer choices and handle missing-data warnings instead of hardcoding merchant privacy defaults.
Google is moving source links higher in AI answers, testing prominent official-site panels and expanding news carousels, while Preferred Sources use has grown more than sevenfold in 2026.
Firefox Enterprise 158 combines a Gecko-based browser with an on-premises management console, domain-level DLP and SIEM export. Initial sales focus on four European countries; ESR support and public pricing are not yet available.
The October 15 Gateway/Workers integration turns a secure web gateway into an application-specific programmable proxy. Teams gain custom request/response handling, but must account for inspection order, WebSocket exclusions and standard Workers billing.
GitHub Actions now has enforceable actor and event rules before a workflow starts, plus a coming default block for a trigger that can expose repository secrets to untrusted fork code.
A new GitHub ruleset can stop unapproved dependency licences at merge time, and agents can check packages before recommending them.
A previously preparatory compliance field is now an operative delivery gate. Builders automating Toll-Free onboarding need to collect, validate and submit policy URLs as part of registration rather than treating them as optional metadata.