Team Research blog
The IncludeSec team explores the practical considerations of AI-assisted source code analysis. Observing results produced with frontier vs locally-hosted models, various harness orchestration designs, and a list of different language frameworks provided us with meaningful insights into how the modern pentester should be using AI to produce higher quality results (but not necessarily in less time!)
The Include Security team attended the BSides 2026 CTF competition and observed how effective frontier models have become at solving a variety of CTF challenges. Our team gives a first-hand account of how the winning strategy has recently shifted to prioritizing efficient solve times and orchestration pipelines that can combine the speed of lighter-weight models on easier challenges with a heavy-hitting model’s reasoning capabilities. We also highlight why the success of LLMs in CTFs does not translate as effectively in the arena of professional security assessments.
The Include Security team takes a foray into the world of audio production equipment in our latest blog post. We look under the hood of a professional-grade audio mixer to explore its security profile, consider how its functionality could be leveraged by an attacker in a real world setting, and develop a proof-of-concept exploit to demonstrate quick n’ easy privilege escalation.
In this post we consider how to think about the attack surface of applications leveraging LLMs and how that impacts the scoping process when assessing those applications. We discuss why scoping matters, important points to consider when mapping out the LLM-associated attack surface, and conclude with architectural tips for developers implementing LLMs within their applications.
Include Security’s latest blog post covers Cross-Site WebSocket Hijacking and how modern browser security features do (or don’t) protect users. We discuss Total Cookie Protection in Firefox, Private Network Access in Chrome, and review the SameSite attribute’s role in CSWH attacks. The post includes a few brief case studies based on situations encountered during real world testing, in addition to a simple test site that can be hosted by readers to explore each of the vulnerability conditions.