Veync Labs
Research into how defences actually fail
Labs exists because the techniques that matter are not in a framework yet. We study how AI guardrails, agent authorization models and detection pipelines break, and publish what defenders can act on.
Research streams
Four streams, one question
Every stream asks the same thing in a different layer: where does the control stop holding, and what is the smallest change that makes it hold again?
Guardrail failure modes
How refusal behaviour erodes across turns, how injection arrives through retrieval and tool channels rather than prompts, and how filters behave under multilingual and multimodal pressure. The output is a taxonomy that minimal reproductions can be filed against.
Agent authorization
Effective authority rather than configured permission: how agents acquire reach through tool chains, where confused-deputy conditions arise when instructions travel in data, and whether revocation actually revokes.
Control evasion
How detection degrades in practice through tuning, exclusions and upgrades, and which categories of action remain invisible in a realistically configured estate. Specific results are released only under NDA.
AI-authored code defects
Which insecure patterns generated code reproduces most reliably, how hallucinated dependency names can be exploited, and how to rank findings by demonstrated exploitability rather than scanner severity.
Advisories
Advisory index
Advisories are published once the affected party has had the opportunity to remediate, or once an agreed disclosure date has passed. An identifier is assigned when a disclosure opens, and the details follow when it closes.
| Identifier | Status |
|---|---|
| VYN-2026-0001 | Under coordinated disclosure |
| VYN-2026-0002 | Under coordinated disclosure |
| VYN-2026-0003 | Under coordinated disclosure |
Coordinated disclosure
How Veync handles what it finds
Veync Labs researchers participate in coordinated vulnerability disclosure and bug-bounty programs across leading AI platforms and model providers.
The principles we work to
- The affected party is contacted first, before any third party and before any publication.
- A reasonable remediation window is offered, and extended on request where the fix is genuinely complex.
- Nothing is published that functions primarily as a working attack against unpatched systems.
- Credit goes to whoever found it, including when that is someone outside Veync.
- We do not use a disclosure as a sales approach to the affected party.
- Where a finding affects a customer's control, it goes to the customer, not into a blog post.
Open frameworks
Contributions to shared frameworks
Adversarial AI is too new for any single vendor's taxonomy to be worth much. The useful work is contributing to the frameworks everyone already maps against.
Adversary technique taxonomies
Submitting observed agent and guardrail failure modes to the public taxonomies that defenders already use for mapping, rather than publishing a proprietary alternative to them.
Application and agentic security lists
Contributing evidence and review to the community lists covering large language model and agentic application risk, where the gap between the list and observed practice is still wide.
Detection content
Publishing detection logic for the technique classes we find to be routinely missed, in a form that can be adapted to whichever detection stack a team runs.
Reproduction harnesses
Releasing minimal reproductions for published advisories so a defender can verify whether their own configuration is affected instead of taking our word for it.
Talks and publications
Where the work is presented
Research is of limited value if it stays internal. Labs publishes written research notes alongside the advisories, and presents the work at security and AI conferences as talks are accepted.
Measuring guardrail erosion across multi-turn conversations
Veync Labs research note · 2026
Effective authority: mapping what AI agents can actually reach
Veync Labs research note · 2026
Research notes are shared with customers and researchers on request. Conference talks are listed here once they have been delivered.
Work with Labs
If you run an AI platform, a detection programme or a research team and the questions above are yours too, we would like to hear from you.
Control-evasion results naming specific products are released only under NDA, through the evidence annex.