Skip to main content
All content

Security Guides, Research & Tools

Research, blog posts, and whitepapers from the BreachLine Labs team.

Nebula by BreachLine
ProductblogFeatured

Meet Nebula: autonomous AI pentesting, explained

Meet Nebula, the AI security engineer inside BreachLine. Give it a task and follow autonomous security work in one software workspace.

11 Sept 2026 4 minBreachline Labs
Read
All articles
Penetration test pricing explained
Industry Analysisblog

What a Penetration Test Includes, and Why Prices Vary

What goes into a penetration test, why prices vary, and what to ask before you buy. Compare AI pentesting plans from £399 a month.

16 Oct 20266 min
Lockfile diff showing a suspicious dependency change
Defensive Securityblog

npm Lockfile Security Review: Checks Before You Merge

npm lockfile security review: check package sources, install hooks and integrity metadata, then record the evidence behind your merge decision.

15 Oct 20266 min
Lockfile diff showing a suspicious dependency change
Defensive Securityblog

Supply Chain Review: A Reproducible Lockfile Lab

Reproduce a supply-chain review with sample npm lockfiles, inspect the evidence, and retest configuration changes using BreachLine's browser tools.

16 Sept 20267 min
Nebula by BreachLine
Technical Architecturewhitepaper

Nebula: An Autonomous AI Security System (Whitepaper)

How Nebula plans tasks, uses tools, keeps project context and turns security work into findings inside the BreachLine SaaS platform.

11 Sept 20266 min
BreachLine research and guides
Industry Analysisblog

Working Exploit vs Scanner Finding for Questionnaires

Working exploit vs scanner finding: what enterprise security questionnaires actually accept, and how to turn coverage into adversarial proof.

9 Sept 20268 min
BreachLine research and guides
Threat Intelligenceblog

llms.txt Is Directing Agents to Install Unowned Code

Researchers found 120 corporate llms.txt files pointing at packages nobody owned. Claude, Codex, and Hermes then installed them inside real networks.

30 Aug 20265 min
BreachLine research and guides
Threat Intelligenceblog

Prompt Injection as RCE: Cursor, VS Code, and Antigravity

Three flaw clusters turned Cursor, VS Code, and Google Antigravity into a remote-code-execution surface in 2026. How each worked, and how to shut it down.

20 Aug 202610 min
BreachLine research and guides
Offensive Researchblog

Active Directory Takeover: Low-Priv to Domain Admin

How an AI security engineer chained DFSCoerce, NetNTLMv1, and DCSync to go from one low-privileged account to Domain Admin, live and fully anonymised.

2 Jun 20268 min
BreachLine research and guides
Vulnerability Researchresearch

SSRF to Cloud Takeover: Anatomy of a Metadata Attack

How a single SSRF reaches the cloud metadata endpoint, steals IAM credentials, and pivots to full account takeover, plus the controls that stop it.

29 May 202613 min
BreachLine research and guides
Productblog

HumanBrowser: How Nebula Pentests Like a Person

Most AI browser tools script clicks and get flagged as bots. HumanBrowser gives Nebula a real Chromium it drives by sight, through an intercepting proxy.

29 May 202611 min
BreachLine research and guides
Threat Intelligenceblog

TeamPCP: The Group Turning Security Tools Into Malware

TeamPCP poisoned Trivy, Checkmarx, and LiteLLM in a 2026 supply chain campaign (CVE-2026-33634). Who they are, what they hit, and how to stop them.

29 May 202614 min
BreachLine research and guides
Vulnerability Researchresearch

JWT Attack Chains: Algorithm Confusion & JWKS Poisoning

The JWT attacks that bypass mature defenses: RS256-to-HS256 confusion, jku/x5u poisoning, kid injection, and cross-service token replay.

28 May 202616 min
BreachLine research and guides
Best Practiceswhitepaper

Software Supply Chain Security: 2026 Playbook

A practical playbook for defending the software supply chain in 2026: the attack patterns behind the year's biggest incidents, and the controls that stop them.

27 May 202613 min
BreachLine research and guides
Industry Analysisblog

Claude Mythos Didn't Kill Pentesting: The Fine Print

Anthropic's Claude Mythos post claimed 181 Firefox exploits and an overnight FreeBSD RCE. The model card's fine print tells a far more careful story.

20 Apr 20268 min
BreachLine research and guides
Industry Analysisblog

AI pentesting tools compared: read the fine print

XBOW raised $120M, Claude Mythos writes exploits overnight, yet curl's maintainer has never seen a valid AI bug report. What actually works versus theatre.

20 Apr 20269 min
BreachLine research and guides
Threat Intelligenceblog

Vercel Breach: One OAuth Token, Full Compromise

Vercel's April 2026 breach traces to one compromised third-party OAuth token from Context.ai. The full attack chain, the IOCs, and the lessons for your team.

20 Apr 202613 min
BreachLine research and guides
Threat Intelligenceblog

The Axios npm Supply Chain Attack: What Teams Need to Know

Attackers backdoored Axios on npm on March 31, 2026, deploying cross-platform RATs in under 3 hours. Here's what happened and how to protect your builds.

31 Mar 202612 min
BreachLine research and guides
Threat Intelligenceblog

LiteLLM Supply Chain Attack: What AI Teams Need to Know

Attackers compromised LiteLLM on PyPI on March 24, 2026, stealing credentials from thousands of AI deployments. Here's what happened and how to respond.

27 Mar 202611 min

Explore