Threat Research

Master C and C++ with our new Testing Handbook chapter

We added a new chapter to our Testing Handbook: a comprehensive security checklist for C and C++ code. We’ve identified a broad range of common bug classes, kno

What we learned about TEE security from auditing WhatsApp's Private Inference

WhatsApp’s new “Private Inference” feature represents one of the most ambitious attempts to combine end-to-end encryption with AI-powered capabilities, such as

Mutation testing for the agentic era

Code coverage is one of the most dangerous quality metrics in software testing. Many developers fail to realize that code coverage lies by omission: it measures

How we made Trail of Bits AI-native (so far)

This post is adapted from a talk I gave at [un]prompted, the AI security practitioner conference. Thanks to Gadi Evron for inviting me to speak. You can watch t

Try our new dimensional analysis Claude plugin

We’re releasing a new Claude plugin for developing and auditing code that implements dimensional analysis, a technique we explored in our most recent blog post.

Spotting issues in DeFi with dimensional analysis

Using dimensional analysis, you can categorically rule out a whole category of logic and arithmetic bugs that plague DeFi formulas. No code changes required, ju

Six mistakes in ERC-4337 smart accounts

Account abstraction transforms fixed “private key can do anything” models into programmable systems that enable batching, recovery and spending limits, and flex

mquire: Linux memory forensics without external dependencies

If you’ve ever done Linux memory forensics, you know the frustration: without debug symbols that match the exact kernel version, you’re stuck. These symbols are

Using threat modeling and prompt injection to audit Comet

Before launching their Comet browser, Perplexity hired us to test the security of their AI-powered browsing features. Using adversarial testing guided by our TR

Carelessness versus craftsmanship in cryptography

Two popular AES libraries, aes-js and pyaes, “helpfully” provide a default IV in their AES-CTR API, leading to a large number of key/IV reuse bugs. These bugs p

Celebrating our 2025 open-source contributions

Last year, our engineers submitted over 375 pull requests that were merged into non–Trail of Bits repositories, touching more than 90 projects from cryptography

Building cryptographic agility into Sigstore

Software signatures carry an invisible expiration date. The container image or firmware you sign today might be deployed for 20 years, but the cryptographic sig

TRMNL

Continuous Glucose Monitoring

A Tour of WebAuthn

Let's Kerberos

C can be memory safe, part 2

Beyond Hamas: Militant and Terrorist Groups Involved in the October 7 Attack on Israel

Explore the military and terrorist groups collaborating with Hamas in the Israel-Hamas War, based on reports and open-source intelligence The post Beyond Hamas:

Chrome support for passkeys in iCloud Keychain

The First 72 Hours of the Israel-Hamas War: Hamas and PIJ Activity on Telegram

Analyzing Telegram's role in facilitating communication and strategy for Hamas and PIJ during the initial days of the Israel-Hamas War. The post The First 72 Ho