Industry Analysis
What a Penetration Test Includes, and Why Prices Vary
What goes into a penetration test, why prices vary, and what to ask before you buy. Compare AI pentesting plans from £399 a month.
Read article
BreachLine Blog
AI Pentesting & Security Blog
Reproducible labs, security analysis and product updates. Explore the evidence, understand the limits and try the methods yourself.
Featured
More from BreachLine
14 articles
Defensive Security
npm Lockfile Security Review: Checks Before You Merge
npm lockfile security review: check package sources, install hooks and integrity metadata, then record the evidence behind your merge decision.
Defensive Security
Supply Chain Review: A Reproducible Lockfile Lab
Reproduce a supply-chain review with sample npm lockfiles, inspect the evidence, and retest configuration changes using BreachLine's browser tools.
Product
Meet Nebula: autonomous AI pentesting, explained
Meet Nebula, the AI security engineer inside BreachLine. Give it a task and follow autonomous security work in one software workspace.
Industry Analysis
Working Exploit vs Scanner Finding for Questionnaires
Working exploit vs scanner finding: what enterprise security questionnaires actually accept, and how to turn coverage into adversarial proof.
Threat Intelligence
llms.txt Is Directing Agents to Install Unowned Code
Researchers found 120 corporate llms.txt files pointing at packages nobody owned. Claude, Codex, and Hermes then installed them inside real networks.
Threat Intelligence
Prompt Injection as RCE: Cursor, VS Code, and Antigravity
Three flaw clusters turned Cursor, VS Code, and Google Antigravity into a remote-code-execution surface in 2026. How each worked, and how to shut it down.
Offensive Research
Active Directory Takeover: Low-Priv to Domain Admin
How an AI security engineer chained DFSCoerce, NetNTLMv1, and DCSync to go from one low-privileged account to Domain Admin, live and fully anonymised.
Product
HumanBrowser: How Nebula Pentests Like a Person
Most AI browser tools script clicks and get flagged as bots. HumanBrowser gives Nebula a real Chromium it drives by sight, through an intercepting proxy.
Threat Intelligence
TeamPCP: The Group Turning Security Tools Into Malware
TeamPCP poisoned Trivy, Checkmarx, and LiteLLM in a 2026 supply chain campaign (CVE-2026-33634). Who they are, what they hit, and how to stop them.
Industry Analysis
Claude Mythos Didn't Kill Pentesting: The Fine Print
Anthropic's Claude Mythos post claimed 181 Firefox exploits and an overnight FreeBSD RCE. The model card's fine print tells a far more careful story.
Industry Analysis
AI pentesting tools compared: read the fine print
XBOW raised $120M, Claude Mythos writes exploits overnight, yet curl's maintainer has never seen a valid AI bug report. What actually works versus theatre.
Threat Intelligence
Vercel Breach: One OAuth Token, Full Compromise
Vercel's April 2026 breach traces to one compromised third-party OAuth token from Context.ai. The full attack chain, the IOCs, and the lessons for your team.
Threat Intelligence
The Axios npm Supply Chain Attack: What Teams Need to Know
Attackers backdoored Axios on npm on March 31, 2026, deploying cross-platform RATs in under 3 hours. Here's what happened and how to protect your builds.
Threat Intelligence
LiteLLM Supply Chain Attack: What AI Teams Need to Know
Attackers compromised LiteLLM on PyPI on March 24, 2026, stealing credentials from thousands of AI deployments. Here's what happened and how to respond.