Project Umbra

Behind the
research.

An independent group investigating software supply chains and memory safety with agentic LLM systems and manual review.

The mandate

An AI security experiment. For the background, see Project Umbra.

Findings are published here only once the vendor has had a chance to fix.

Read the disclosed research

Coordinated disclosure

We report issues privately to the affected vendor and give them 90 days to ship a fix before anything is published. The clock starts on first contact.

If a vendor responds quickly, asks for more time in good faith, or the issue is already being exploited in the wild, we adjust the timeline accordingly. Technical detail stays embargoed until disclosure.

The team