Research reports
6 published
Is gating a model the same as containing a capability? Gemini 4 Carbon leads the cyber benchmarks Google published, but the gate concentrates one model while the capability class diffuses on a 4–7-month clock.
Security-specialized AI can help uncover and validate vulnerabilities, but access controls and verified deployment determine whether defenders close the patch gap.
A crafted GitHub comment hijacked Claude Code, Gemini CLI and Copilot Agent into leaking their own repository's keys — and the record says prevention is not available, containment is.
How do two PHP request-lifecycle flaws enable remote code execution, and why is patching the only complete fix?
Are shadow AI risks best contained by bans—or by visibility and controls?
Can any mitigation short of patching stop an unauthenticated RCE that runs before your application code?