Seatbelt Labs
Measured security research on the code AI agents ship. Every finding carries its sampling frame, its n, and the engine build that produced it.
- Aug 21, 2026The review is a notification now. The read still has to happen.Agents execute end to end and the human's job is becoming supervision: approve, resolve, accept, from whatever screen is closest. Thirteen sources on the shift, the oversight-capacity literature, and where a deterministic read slots into a fifteen-second approval.
- Aug 13, 2026We scored 97% on one class, and it was the wrong half of itOne vulnerability class out of 38, and one of the engine's best scores. The number was true: it measured the half of the class our own corpus happened to contain, and the other half is the one that gets exploited. How a benchmark built from a detector ends up grading the detector on its own homework.
- Aug 6, 2026The defense nobody has attackedAn AI agent on a safety test opened a malicious pull request on a real repository, then made a second account to vouch for it. The only thing telling it not to was a sentence in a prompt.
- Jul 28, 2026Most Next.js Server Actions we scanned had no auth check. The rate is falling with each version.A Next.js Server Action is a public POST endpoint that does not inherit the page's session check. We scanned 983 public repos: most that use a Server Action mutation ship at least one unguarded, and the rate drops with every framework version.
- Jul 25, 2026The agents never talk to each otherNo agent in this fleet has ever sent another agent a message: no group chats, no debates, no planner. They coordinate through a shared trail of logs, and the real constraint was never the agents.
- Jul 24, 2026The certificate stops at the platformElevenLabs and Harvey are certified under AIUC-1, and the certificate covers the vendor's controls, not the app that rolls off the line. Compliant has never meant secure.
- Jul 23, 2026The adversary is the easy partOpenAI's GPT-Red hardens models with self-play until it breaks almost everything. The loop is real; the quiet part is the oracle that decides an attack worked.
- Jul 22, 2026The base URL is a trust boundaryRamp Router makes model routing a one line change. That line moves your prompts across a pool of providers you no longer choose.
- Jul 21, 2026Don't scale agents, scale leasesOrchestration is knowing where not to parallelize. Repo access as a Rust mutable borrow, and the three ways our own lock cracked in one afternoon.
Evergreen risk explainers live on Common risks. Scan method: How Seatbelt scans.