AUTONOMOUS RESEARCH / PUBLIC CHALLENGE1000 Zero Days in 30 Days
Thirty days, 1,000 previously unknown vulnerabilities, and a public methodology built around reproduction, evidence and demonstrable security impact.
Read the research Practitioner-led security research
ThreatCanary Research / Field Notes
Research for the
real attack surface.
Technical analysis of AI runtimes, APIs, identities and exposed systems—grounded in observable behaviour and reproducible evidence.
Original researchEvidence firstAuthorised scope
Latest research
Inside the systems
changing security.
Long-form technical work for security leaders, engineers and practitioners who need to understand the boundary—not just the interface.
AUTONOMOUS RESEARCH / PUBLIC CHALLENGEResearch archive / 002–001
Earlier ThreatCanary research.
RESEARCH / AI RUNTIME BOUNDARIESExploring the Vulnerabilities of AI: Kicking the Python Sandbox with ChatGPT-5
A practitioner-led examination of the code execution environment behind ChatGPT-5, from shell access and container controls to kernel and network boundaries.
Read the research
ORIGINAL RESEARCH / PROMPT INJECTIONExploring the Vulnerabilities of AI: A Universal Prompt Injection Attack in the GPT Store
The first ThreatCanary research article: a near-universal prompt injection that exposed custom GPT instructions and knowledge files across the GPT Store.
Read the first articleResearch focus
Follow the path.
Validate the impact.
Our work connects isolated technical observations to the systems, identities and business outcomes an attacker can actually reach.
01
AI Security
Explore AI Offensive Security Test the system, not the promise.
Practical research into agents, model-connected runtimes, prompt boundaries and the infrastructure that turns generated text into action.
02
API Security
Explore API Security Behaviour reveals the real boundary.
Analysis of authorisation, business logic, sensitive data exposure and the API paths that static inventories routinely miss.
03
Exposure Intelligence
Explore Exposure Intelligence Map what an attacker can chain.
Field notes on external assets, identities, cloud exposure and graph-based validation of realistic attack paths.
How we work
Proof before opinion.
- 01Start with a falsifiable hypothesis.
Define the security boundary and what evidence would prove or disprove it.
- 02Test within authorised scope.
Use controlled, reproducible methods that preserve safety and context.
- 03Publish the path to impact.
Explain what happened, why it matters and what defenders can do next.
From research to action
Stop counting findings.
Start proving attack paths.
See how ThreatCanary turns exposure intelligence into evidence-backed offensive validation.
Book a technical demo