Team Research blog
Our team examines abliterated models and what scenarios in which security professionals should consider using them. This post briefly explains abliteration as a concept, discusses how it might make exploit development easier, and also discusses the risks of the current abliteration model landscape.
Android application developers often store sensitive data to disk, relying on physical device security and process isolation to prevent attackers from obtaining that data. This goes against security best practices, and doesn’t take advantage of the latest tools made available by Google to mitigate the risk of locally-stored sensitive data. This post explores what those tools are, discusses previous (now deprecated) methods for securing data locally, and provides recommendations for what Android developers should do if storing sensitive data is unavoidable.
In this post we look under the hood of BrightData’s SDK and how it turns ordinary consumer TVs into exit nodes of an enormous commercial, residential proxy network leveraged by the AI industry to scrape web data and train language learning models.
The Include Security team attended the BSides 2026 CTF competition and observed how effective frontier models have become at solving a variety of CTF challenges. Our team gives a first-hand account of how the winning strategy has recently shifted to prioritizing efficient solve times and orchestration pipelines that can combine the speed of lighter-weight models on easier challenges with a heavy-hitting model’s reasoning capabilities. We also highlight why the success of LLMs in CTFs does not translate as effectively in the arena of professional security assessments.
Are you using Terraform to build or configure your AWS environment? You might be surprised by configuration settings that introduce vulnerabilities by default, particularly if you’re already familiar with using the AWS or other cloud provider interfaces for asset creation. This post focuses on the slowly growing security divide of AWS asset security settings when created by the Terraform provider vs the AWS UI.