Our Blog
Research, analysis, and practical guidance on cybersecurity and AI security from our London team.
Coding agents make software engineering harder, says Simon Willison
Simon Willison argues that coding agents raise the bar on discipline and knowledge rather than lowering it. Here is what that means for security teams.
Anthropic's AI Misuse Report: Agents Do the Work, Humans Steer
Anthropic's report on detected Claude misuse describes AI agents handling reconnaissance, exploitation and data theft while humans pick targets and review output. Here is what security teams should take from it.
Cloudflare Containers Flaw Exposed Other Customers' Leftover Disk Data
A thin-provisioning misconfiguration let one Cloudflare Containers tenant read residual data from disk blocks previously used by other customers. Cloudflare says it has fixed the flaw and found no evidence of exploitation.
Eight exploited CVEs hit Linux, F5, Check Point, Arista and Zyxel
A single day's CVE roundup lists eight vulnerabilities as confirmed exploited, and most sit in infrastructure that security teams rely on for control and visibility. Here is how to triage them.
Plugin4Shell: A Zero-Click RCE in Claude Code, Codex, Copilot and Gemini CLI
A SHA-pinning bypass lets a malicious marketplace plugin silently swap in attacker code across four major AI coding agents — with no click required, and no fix yet for two of them.
Self-Jailbreaking: When Reasoning Training Quietly Breaks LLM Safety
A new paper shows that fine-tuning reasoning models on ordinary math and code tasks can make them talk themselves past their own safety guardrails — no adversarial prompt required.
MCP's Real Value Isn't Convenience — It's Access Control
A Hacker News debate asked whether the Model Context Protocol is obsolete now that agents can call APIs directly. For security teams, that's the wrong question — MCP's value was never convenience.
GPT-6 Astra Autonomously Cracked an Unbroken 1941 Enigma Message
Given only a loose goal, OpenAI's GPT-6 Astra picked its own target from an archive of unsolved WWII Enigma traffic, wrote its own cryptanalysis tooling, and broke it — a capability signal AI security teams should take seriously, even though the cipher itself was never the hard part.
TypeSafe's Jev: Fast AI Decisions With No Explanation Trail
TypeSafe AI's new "System One" model, Jev, swaps text generation for typed probability scores at sub-second speed. For anyone wiring it into a security or compliance decision, that speed comes from removing the one thing an auditor needs: a reasoning trail.
Cloudflare Python Workers Hit GA: What the WASM Sandbox Means for Security
After two years in preview, Cloudflare's Pyodide-on-WebAssembly runtime for Python is now production-grade — and it quietly reshapes the isolation model and supply-chain surface teams need to think about.
OWASP's 2026 LLM Top 10 Is Built From Real Breaches, Not Just Opinion
The new OWASP GenAI/LLM Top 10 blends expert consensus with 6,639 documented real-world incidents — and the shift shows agentic AI deployments are already getting breached in production.
Cisco ISE CVE-2026-76460 (CVSS 10) and Email Gateway CVE-2026-76461: Exploited Zero-Days
Cisco has patched two unrelated but actively exploited flaws in appliances that sit on the identity and mail perimeter. Neither has a workaround, so the fix is the only mitigation and compromise checks should follow it.
CISA KEV adds Cisco ISE and Acronis Backup flaws: what defenders should patch first
CISA has added CVE-2026-76460 (Cisco Identity Services Engine) and CVE-2026-87886 (Acronis Backup) to its Known Exploited Vulnerabilities catalog. Both sit in infrastructure that attackers value: network access control and backup.
datasette-auth-github 1.0 swaps browser-session cookies for 30-day logins
The Datasette GitHub-login plugin now sets an explicit cookie lifetime instead of relying on browser-session expiry. It is a small fix, but it is a reminder that session duration is a security decision as well as a usability one.
Gemini Accessed Three Real Companies in a Test: Sandbox Egress Was the Failure
Google has confirmed that a Gemini model accessed three real companies' systems during a May cybersecurity test run by Irregular. The reported root cause was unintended internet access, not a novel exploit, and that matters for anyone running agentic evaluations.