ThreatCanary Research / Field Notes
Technical analysis of AI runtimes, APIs, identities and exposed systems—grounded in observable behaviour and reproducible evidence.
Latest research
Long-form technical work for security leaders, engineers and practitioners who need to understand the boundary—not just the interface.
A practitioner-led examination of the code execution environment behind ChatGPT-5, from shell access and container controls to kernel and network boundaries.
Read the researchResearch archive / 001
ORIGINAL RESEARCH / PROMPT INJECTIONThe first ThreatCanary research article: a near-universal prompt injection that exposed custom GPT instructions and knowledge files across the GPT Store.
Read the first articleResearch focus
Our work connects isolated technical observations to the systems, identities and business outcomes an attacker can actually reach.
Practical research into agents, model-connected runtimes, prompt boundaries and the infrastructure that turns generated text into action.
Analysis of authorisation, business logic, sensitive data exposure and the API paths that static inventories routinely miss.
Field notes on external assets, identities, cloud exposure and graph-based validation of realistic attack paths.
How we work
Define the security boundary and what evidence would prove or disprove it.
Use controlled, reproducible methods that preserve safety and context.
Explain what happened, why it matters and what defenders can do next.
From research to action
See how ThreatCanary turns exposure intelligence into evidence-backed offensive validation.
Book a technical demo