All the research, one tab.
Every research item behind the daily briefs, newest first, in fast pages. Filter by topic, open any card's source, share any page — the URL is the state. The live map stays on the Brief page.
- Dev Tooling & Infra✓ verified
Anthropic Claude Security / codebase scanning (Project Glasswing)
Security tooling from the platform AI Uni builds on — relevant to the three-skill security-review discipline and to the Anthropic Security Plugin install this session.
- Dev Tooling & Infra✓ verified
Researcher shows one malicious GitHub issue could hijack repos running Claude Code's GitHub Action
CI/CD-embedded coding agents inherit the write access of the workflow they run in — treat any agent-triggering input (issue titles, PR bodies, comments) from an untrusted user as untrusted, patched or not.
- Dev Tooling & Infra✓ verified
GitHub Copilot moves every plan to token-metered 'AI Credits'
Usage-metered agent tooling makes cost track how hard your agents actually work — the same budgeting shift teams hit running their own multi-agent lanes.
- Dev Tooling & Infra✓ verified
GitHub lets you assign a dependency alert straight to an AI agent to fix
Dependency triage is fatigue-heavy toil an agent can genuinely take off your plate — as long as the merge stays a human decision.
- Dev Tooling & Infra✓ verified
A poisoned npm package quietly rewrote a coding agent's memory — and it reloaded every session
Treat any automatic edit to an agent's memory or instruction files as a reviewable event, not a silent auto-load — a single poisoned dependency can otherwise steer every future run.
- Dev Tooling & Infra✓ verified
mem0 / agent-memory architectures maturing
AI Uni's own memory-architecture work sits in this fast-moving category — the anti-evaporation problem the platform substrate solves.
- Dev Tooling & Infra
KV-cache agent-state persistence: reported 89% better completion, 67% fewer calls
If the effect holds, strong evidence for on-disk substrate-loading + persistence work. UNVERIFIED effect size — find the primary benchmark before citing the numbers.
- Dev Tooling & Infra✓ verified
Agent observability field: LangSmith vs Braintrust vs Langfuse vs Arize
Informs deterministic-vs-LLM-judge layering. Braintrust's merge-blocking eval-action is a pattern to study — but LLM-judge stays post-hoc, never replacing deterministic CI gates.
- Dev Tooling & Infra✓ verified
'ClawHavoc': 900+ malicious agent 'skills' pushed through a third-party marketplace
Any skill, tool, or config you didn't write deserves the same scrutiny as a code dependency — and 'delete the skill' is not the same as 'undo what it did.'