How we made Trail of Bits AI-native (so far)
This post is adapted from a talk I gave at [un]prompted, the AI security practitioner conference. Thanks to Gadi Evron for inviting me to speak. You can watch the recorded presentation below or downlo
Search Intelligence
Spotting issues in DeFi with dimensional analysis
Using dimensional analysis, you can categorically rule out a whole category of logic and arithmetic bugs that plague DeFi formulas. No code changes required, just better reasoning! One of the first le
How World ID wants to put a unique human identity on every AI agent
Iris scan-backed tokens could help stop agent swarms from overwhelming online systems.
Researchers disclose vulnerabilities in IP KVMs from four manufacturers
Internet-exposed devices that give BIOS-level access? What could possibly go wrong?
With developer verification, Google's Apple envy threatens to dismantle Android's open legacy
Questions remain as Google prepares to lock down Android app distribution in the name of security.
New AirSnitch attack bypasses Wi-Fi encryption in homes, offices, and enterprises
That guest network you set up for your neighbors may not be as secure as you think.
Using threat modeling and prompt injection to audit Comet
Before launching their Comet browser, Perplexity hired us to test the security of their AI-powered browsing features. Using adversarial testing guided by our TRAIL threat model, we demonstrated how fo
Carelessness versus craftsmanship in cryptography
Two popular AES libraries, aes-js and pyaes, “helpfully” provide a default IV in their AES-CTR API, leading to a large number of key/IV reuse bugs. These bugs potentially affect thousands of downstrea
Celebrating our 2025 open-source contributions
Last year, our engineers submitted over 375 pull requests that were merged into non–Trail of Bits repositories, touching more than 90 projects from cryptography libraries to the Rust compiler. This wo
Building cryptographic agility into Sigstore
Software signatures carry an invisible expiration date. The container image or firmware you sign today might be deployed for 20 years, but the cryptographic signature protecting it may become untrustw
Millions of people imperiled through sign-in links sent by SMS
Even well-known services with millions of users are exposing sensitive data.
Many Bluetooth devices with Google Fast Pair vulnerable to “WhisperPair” hack
Even Google's own earbuds are vulnerable to the Fast Pair hack.
Google will end dark web reports that alerted users to leaked data
Google says the reports lacked "helpful next steps."
Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking
Cellebrite can apparently extract data from most Pixel phones, unless they're running GrapheneOS.
Insider Threats Loom while Ransom Payment Rates Plummet
The percentage of companies choosing to pay ransoms dropped significantly, while threat actors shift their tactics in response to decreasing profits.
A biological 0-day? Threat-screening tools may miss AI-designed proteins.
Ordering DNA for AI-designed toxins doesn't always raise red flags.
Google confirms Android dev verification will have free and paid tiers, no public list of devs
Google promises verification will make Android safer, but at what cost?
Former WhatsApp security boss in lawsuit likens Meta’s culture to a “cult”
Meta allegedly prioritized user growth over security, lawsuit said.
After $380M hack, Clorox sues its “service desk” vendor for simply giving out passwords
Massive 2023 hack was easily preventable, Clorox says.