research

We publish the receipts.

Coordinated disclosures and security-posture research, in the open. Cadence over noise. The work is what builds the trust the marketing can't.

latest · analysis

The prompt said there was no internet.

Two frontier labs published containment postmortems in July. They failed at the same layer in two different ways, and the same architecture is running in your CI right now. With the canary that would have caught it, and the six questions we ask of any package proxy.

by Gal Ankonina · 2 August 2026 · 7 min read Read it →
also in the pipeline
Open source security? Fugazi. We scanned the 40 most-used open-source projects, plus curl, and got 30,333 scanner alerts. Then we verified them.
drafting
Exposure research on a widely-adopted AI component, and its downstream blast radius.
drafting
Coordinated-disclosure write-ups, published as each embargo lifts.
ongoing

Disclosures and press: security@cliffsecurity.ai. Verified findings live on the proof page.