Research Ideas
High-potential research with the edge that comes from acting on it before others do.
Workflow automation flaws: how a public form lets attackers steal stored credentials
Self-host n8n or a similar automation tool? One message through a public form can hand over every password it stores. Patch now — and check for a break-in first.
What it is: Research from Pillar Security showing that the automation tools many companies run to connect their apps — n8n is the main example, used by over 230,000 organisations — can be taken over from the internet through the formulas users are allowed to write.
Who it's for: Any company that self-hosts such a tool, or builds AI "agent" systems the same way.
The catch: The n8n holes are already patched, so an up-to-date copy is safe from these exact attacks; the researchers' wider claim — that this style of safety limit can never be fully secured — is a well-evidenced view, not a proof.
Google's method for checking quantum computer answers, for R&D teams
What it is: A quantum computer is a new kind of computer built on the physics of atoms. It works with qubits, the quantum version of an ordinary computer's bits, which lets it take on problems ordinary computers struggle with, such as how molecules behave. Today's machines are noisy: tiny disturbances cause small errors as they run, so their answers come out slightly wrong. The long-term fix, called error correction, is machines that repair their own errors while they work, and those are still being developed. Until they arrive, every answer is corrected afterwards by calculation, called error mitigation, and the authors expect it to stay useful even after. This paper, from Google's quantum research team, is a better method of error mitigation.
Who it's for: Any company paying for quantum computer work in chemistry or materials. A quantum computer's answer is only as good as the error mitigation behind it, and this method tells you whether to trust it. Machine time is bought in shots, single runs of the program, and in the authors' simulations this method needed 10 to 100 times fewer of them.
The catch: It is not yet proven on real hardware. Every new result in the paper comes from computer simulations of small, 16-qubit circuits; a circuit is the program a quantum computer runs. Only an earlier, simpler version has run on Google's own machine.
Secure LiDAR chip: a sensor that rejects fake laser signals, for carmakers
What it is: A prototype chip, built by researchers at Keio University in Japan, for the LiDAR on a self-driving vehicle: the laser sensor that tells the vehicle how far away every person and object is, by timing how long its laser flashes take to bounce back. The chip lets the sensor tell its own returning flashes apart from fake ones an attacker shines at it.
Who it's for: Companies that build or run self-driving vehicles. What they gain is a sensor that keeps seeing a pedestrian during a laser attack; in the researchers' test, the same sensor without the chip's check lost that pedestrian completely.
The catch: It is a lab prototype, not a product you can buy. Under attack it kept 73 of every 100 measurements, not all of them, and the protection was proven on recorded data, not yet live on the chip.