Running With Scissors - The Disclose.io Blog

Sign in Subscribe

Policy Pulse - Issue #26 | Week of July 25, 2026

Policy Pulse - Issue #26 | Week of July 25, 2026

OpenAI's own evaluation models breached Hugging Face, triggering a bipartisan AI Kill Switch bill within 48 hours. A federal judge separately orders published iPhone exploit research deleted on trade-secret grounds.

Policy Pulse - Issue #25 | Week of July 18, 2026

Policy Pulse - Issue #25 | Week of July 18, 2026

CISA, NSA, and allied agencies from the UK, Netherlands, and Japan jointly tell vendors how to run a VDP, safe-harbor language included. Plus: AI-scale disclosure overwhelms maintainers, and the White House launches Gold Eagle.

DNS Security TXT, Five Years On

DNS Security TXT, Five Years On

Five years after we proposed publishing your security contact in DNS, the standard has one canonical home, a required freshness field, an Internet-Draft, and 181 domains found in the wild.

Policy Pulse - Issue #24 | Week of July 11, 2026

Policy Pulse - Issue #24 | Week of July 11, 2026

GPT-5.6 Sol goes public as Washington lifts its access gate, and UK AISI finds universal cyber jailbreaks within hours, the same pattern that forced Anthropic's Fable 5 offline. Plus Illinois mandates frontier AI safety audits.

Bring lookup.disclose.io Into Your Workflow

Bring lookup.disclose.io Into Your Workflow

lookup.disclose.io now plugs into the tools you already use: a CLI, Caido and Burp Suite plugins, an MCP server for AI agents, plus the web app and API. Try them, and tell us what to fix.

Policy Pulse - Issue #23 | Week of July 4, 2026

Policy Pulse - Issue #23 | Week of July 4, 2026

Washington lifts export controls on Anthropic's frontier cyber models two weeks after locking them down. Plus Akrites launches to absorb AI-scale disclosure and ENISA's CVE Root appoints a new CNA.

What Makes a Vulnerability Report Excellent

What Makes a Vulnerability Report Excellent

curl maintainer Daniel Stenberg has triaged 1,000+ vulnerability reports. His field guide on reporting well is the other half of safe harbor — and the antidote to AI-generated slop.

Policy Pulse - Issue #22 | Week of June 28, 2026

Policy Pulse - Issue #22 | Week of June 28, 2026

GPT-5.6 Sol joins Mythos 5 behind the federal access wall as the US government locks in its frontier AI gatekeeping regime. UK CMA reform's statutory defence covers only 300 of 69,600 researchers. DMCA Section 1201 petitions open through August 24.

Feedback Requested: Coordination is going API-first. Contact Discovery and Attribution still aren't solved.

Feedback Requested: Coordination is going API-first. Contact Discovery and Attribution still aren't solved.

Vulnerability coordination is going API- and MCP-driven, but attribution and contact discovery are still the hard part. What's new in lookup.disclose.io — and where we want your feedback.

Policy Pulse - Issue #20 | Week of June 20, 2026

Policy Pulse - Issue #20 | Week of June 20, 2026

Three days after Anthropic shipped Mythos 5 to vetted defenders, the US government used export control to recall it worldwide. CISA's BOD 26-04 also retires the fixed-deadline KEV model for a risk score.

Policy Pulse - Issue #19 | Week of June 13, 2026

Policy Pulse - Issue #19 | Week of June 13, 2026

Trump's Executive Order 14409 stands up a federal AI cybersecurity clearinghouse, but benchmarks machine-found vulnerabilities while saying nothing about how they reach defenders. Plus: CISA opens KEV nominations to researchers.

Above the Parapets: The Chilling Effect Finally Has Receipts

Above the Parapets: The Chilling Effect Finally Has Receipts

The first qualitative study of researchers' lived experiences of legal risk: Sunoo Park and Daniel R. Thomas (USENIX Security 2026) on how overbroad anti-hacking law chills good-faith security research — and why it names disclose.io as part of the fix.