Seatbelt LabsNotes and research on how we build Seatbelt.https://labs.withseatbelt.com/2026-08-13T00:00:00ZWe scored 97% on one class, and it was the wrong half of ithttps://labs.withseatbelt.com/the-wrong-half-of-the-class2026-08-13T00:00:00Z2026-08-13T00:00:00ZConnorOne vulnerability class out of 38, and one of the engine's best scores. The number was true: it measured the half of the class our own corpus happened to contain, and the other half is the one that gets exploited. How a benchmark built from a detector ends up grading the detector on its own homework.The defense nobody has attackedhttps://labs.withseatbelt.com/the-defense-nobody-has-attacked2026-08-06T00:00:00Z2026-08-06T00:00:00ZConnorAn AI agent on a safety test opened a malicious pull request on a real repository, then made a second account to vouch for it. The only thing telling it not to was a sentence in a prompt.Most Next.js Server Actions we scanned had no auth check. The rate is falling with each version.https://labs.withseatbelt.com/nextjs-server-action-auth2026-07-28T00:00:00Z2026-07-28T00:00:00ZConnorA Next.js Server Action is a public POST endpoint that does not inherit the page's session check. We scanned 983 public repos: most that use a Server Action mutation ship at least one unguarded, and the rate drops with every framework version.The agents never talk to each otherhttps://labs.withseatbelt.com/agents-never-talk2026-07-25T00:00:00Z2026-07-25T00:00:00ZConnorNo agent in this fleet has ever sent another agent a message: no group chats, no debates, no planner. They coordinate through a shared trail of logs, and the real constraint was never the agents.The certificate stops at the platformhttps://labs.withseatbelt.com/the-certificate-stops-at-the-platform2026-07-24T00:00:00Z2026-07-24T00:00:00ZConnorElevenLabs and Harvey are certified under AIUC-1, and the certificate covers the vendor's controls, not the app that rolls off the line. Compliant has never meant secure.The adversary is the easy parthttps://labs.withseatbelt.com/the-adversary-is-the-easy-part2026-07-23T00:00:00Z2026-07-23T00:00:00ZConnorOpenAI's GPT-Red hardens models with self-play until it breaks almost everything. The loop is real; the quiet part is the oracle that decides an attack worked.The base URL is a trust boundaryhttps://labs.withseatbelt.com/the-base-url-is-a-trust-boundary2026-07-22T00:00:00Z2026-07-22T00:00:00ZConnorRamp Router makes model routing a one line change. That line moves your prompts across a pool of providers you no longer choose.Don't scale agents, scale leaseshttps://labs.withseatbelt.com/lease-based-fleets2026-07-21T00:00:00Z2026-07-21T00:00:00ZConnorOrchestration is knowing where not to parallelize. Repo access as a Rust mutable borrow, and the three ways our own lock cracked in one afternoon.