Articles and Dossiers
Research, intelligence dossiers, and technical publications from MC Project Lab.
Articles and Dossiers
Editorial archive and AI security research reports.
Short links and cloud documents: what can be logged when we click
Technical analysis on redirects, Bitly shorteners, Google Workspace Activity Dashboard, and cloud document handling: what is logged, what stays private, and security best practices.
The AI-Found Breach: The Cathedral Case and the New Frontiers of Cybersecurity
AI Security Intelligence Dossier 001/2026: Cathedral-Anthropic investigation, AI agents for vulnerability discovery, third-party enterprise software, and organizational security.
The fm command in macOS 27 and Apple's language models
What Apple and independent guides document about the fm command in macOS 27 and the AFM 3 model family: commands, context, Private Cloud Compute, evaluations and privacy.
The Church and Artificial Intelligence
Faith, ethics, and innovation: the Church's role in technological transformation
Faith, ethics, and innovation: the Catholic Church's engagement with artificial intelligence, from the Rome Call to Pope Leo XIV's encyclical Magnifica Humanitas.
PwC-Everest: confirmed incident at a third-party vendor. What we know about the 590 GB claim and SaaS supply chain risks
PwC confirms to Reuters a cybersecurity incident involving a third-party vendor used to host employee learning records. Everest claims 590 GB: verified facts, unverified assertions, and SaaS supply chain security.
AI agents and responsibility: who controls artificial intelligence? Who answers for its actions?
AI agents and responsibility: providers' contractual terms, the Google Cloud case, European regulation and the first court decisions. Who answers when an agent gets it wrong?
MITRE ATT&CK v20 updates Enterprise and ICS matrices across AI agents and water utilities
With the October 13, 2026 release, five AI-specific entries enter the MITRE ATT&CK v20 Enterprise matrix alongside two real-world campaigns, from the agent-assisted breach in Mexico to PLC lockouts at water utilities in Minnesota.
The Phantom PA · From fake public portals to campaign detection
From seizures of AI-generated fake court portals to phased phishing campaigns: how to detect and correlate fake Italian public administration digital services without relying on pre-existing blacklists. The Site Trust Analyzer v0.6.0 experiment.
From AI to SI, why the United States is renaming artificial intelligence
On 29 September 2026 Trump signs the order replacing AI with Super Intelligence in the federal executive branch. What actually changes, the technical and geopolitical knot, and why capability is not authorisation.
What an AI Agent Does When the Expected Path Is Blocked
Testing divergence and adaptive behavior in frontier AI agents facing blocked paths and access restrictions.
IAmNotAVillain: From GitHub Traces to the “Italy Files”
From GitHub OSINT traces and on-chain analysis to underground listings and the ‘Italy Files’: sources, timeline and claims still awaiting verification.
The Revolut case is not about Revolut: what a compromised institutional identity is worth
A compromised Italian government certified mailbox, fake data requests and 680 customer files handed over. Why the problem is trust between systems, not one bank's security, and what has to change on the receiving end.
The real AI bottleneck: generating is cheap, verifying is costly
While public debate focuses on apocalyptic warnings, business faces a concrete asymmetry: generating answers costs almost nothing, but verifying them requires time and methodology.
A cookie lasting one year and the question that led to Cookie Tracker
An audit of a B2B registration page found a persistent identifier cookie without Secure and HttpOnly. This finding led to Cookie Tracker.
When AI understands what you are trying to achieve
The Russian operation uncovered by OpenAI on August 25, 2026 shows that the use of an AI assistant leaves signals about a much broader operation. From checking a single prompt to inferring intent, and the limits this entails.
Automated document readers: where Italian justice stands
In Brazil, an AI system reviewing court filings intercepted a hidden prompt inside an appeal. In Italy, that reader is not online yet, and the European postponement gives time to decide how to handle incoming external documents.
AI Act and Digital Omnibus: Deadlines, Compliance, and Impact
Analysis of European AI Act enforcement timelines, regulatory governance, and compliance roadmaps.
Validate, Don't Hypothesize: The Local Agentic Security Revolution
Technical dossier by MC Project Lab on AI agent log security, active offensive validation, local cryptographic audit trails, and AI Act compliance with LogArmor and Replay.
GPT-Red and Fake Chain-of-Thought: How to Deceive Reasoning Models
Dossier by MC Project Lab on OpenAI's GPT-Red announcement, automated batch testing limits, and the fake chain-of-thought threat to LLM safety alignment.
Build, secure, slow down: the three forces of AI in a single week
Between late July and early August 2026, three signals reveal where artificial intelligence is headed: NVIDIA measures the impact of the harness, the Open Secure AI Alliance is born, and over 71,000 people sign a statement for a moratorium on superintelligence.
The Criminal AI Toolbox
Defensive overview of AI-based criminal tools documented by security researchers and MITRE ATLAS: deepfake for KYC, LLM without guardrails, malware generating commands with AI, phishing, and credential theft.
A Real-Time Deepfake Bypasses Facial Recognition. The Problem Isn't Liveness, It's Where You Look
iProov's Red Team demonstrated a deepfake injection attack that bypasses KYC facial verification for banks and exchanges. Documented by MITRE ATLAS (AML.CS0033). What it is, why liveness detection misses it, and countermeasures that hold up.
Introducing Space Observatory: The Italian Atlas of the Space Economy
MC Project Lab launches Space Observatory: verified data on satellite constellations, launchers, industry, and space regulations, with live tools and always cited sources.
A Hacker Gave One Command: AI Attacked 460 Systems on Its Own
MC Project Lab dossier on the Hermes Agent/DeepSeek case documented by Unit 42: an attacker delegated the entire attack chain to an autonomous AI agent with a single command via Telegram.
An AI Breached Three Companies Alone. Replicating the Anthropic Incident in the Red Team Simulator
MC Project Lab dossier on the Anthropic and OpenAI/Hugging Face incidents of July 2026, and how TCT's Red Team Simulator replicates the same pattern to test AI agents.
Have Five Agents Write It: The Divergence Test
MC Project Lab dossier on the divergence test: how to stress software specifications by having multiple AI agents compete in parallel with Divergo.
When Benchmarks Don't Reflect Real Use: The Kimi Case
MC Project Lab dossier on the real token consumption of Kimi Code: 1,449,154 tokens recorded in about nine minutes during a work session.
Scenario: When Artificial Intelligence Decides to Cheat
Illustrative scenario by MC Project Lab: how an AI system might bypass a security test to maximize its score. Lessons on control, guardrails, and local models, with references to documented cases of reward hacking.
AI Act Article 50: Transparency Requirements and Synthetic Content
Detailed technical analysis of disclosure duties for generative AI and synthetic media under the EU AI Act.
Chinese AI Models, Double-Edged Convenience: The Map of Business Risks
Analysis of the risks of using Chinese AI model APIs (Kimi K3, DeepSeek) for privacy and business continuity, and the solution of protected local execution.
The Energy Impact of Artificial Intelligence: The Big Tech Nuclear Race
Dossier on the energy impact of generative AI, data center demands, Big Tech's nuclear energy agreements, and implications for the power grid.
The Battle for Encryption: Chat Control and the Right to Privacy
MC Project Lab dossier on Chat Control, end-to-end encryption (E2EE), client-side scanning, and the right to communication privacy.
AI Agents and Data: What AgentScoope Revealed
MC Project Lab dossier on AgentScoope: results of controlled tests on Claude, Codex, Grok, Antigravity, and Kimi Code.