AI · Cybersecurity · AI for Cyber · Cyber for AI
Every claim traces to a source.
Interactive research explainers and deep dives on AI, cybersecurity, and where the two collide.
Four areas
Models, agents, and the research behind them — what changed and whether the evidence holds.
First report coming soon
2 reportsVulnerabilities, exploitation, and defense — traced to advisories, patches, and primary sources.
PHP2Shell: When a Request Outlives Its Memory
2 reportsWhere AI changes detection, response, and offense — and where the claims outrun the data.
Gemini 4 Carbon: The Frontier Behind a Gate
2 reportsSecuring models, data, and agents: prompt injection, supply chain, and model abuse.
Indirect Prompt Injection: When the Data Your AI Agent Reads Becomes the Attacker
Recently published
Is gating a model the same as containing a capability? Gemini 4 Carbon leads the cyber benchmarks Google published, but the gate concentrates one model while the capability class diffuses on a 4–7-month clock.
Security-specialized AI can help uncover and validate vulnerabilities, but access controls and verified deployment determine whether defenders close the patch gap.
A crafted GitHub comment hijacked Claude Code, Gemini CLI and Copilot Agent into leaking their own repository's keys — and the record says prevention is not available, containment is.
How do two PHP request-lifecycle flaws enable remote code execution, and why is patching the only complete fix?
Are shadow AI risks best contained by bans—or by visibility and controls?
Can any mitigation short of patching stop an unauthenticated RCE that runs before your application code?
Inside every report
Every report opens with the answer and the confidence behind it, then shows the work.
Each number links to a dated, classed source. Estimates, forecasts and gaps are labelled as such.
Each report names the signals that would prove it wrong, so you know what to watch next.
Get new reports as they land.
Follow in any feed reader, or point an RSS-to-email tool at the feed. No account, no tracking.