Google Project Zero has examined a bypass of Administrator Protection, a Windows 11 25H2 feature intended to replace UAC with more controlled elevation. The finding makes privilege boundaries, workstation hardening, and least-privilege testing immediate concerns for engineering teams.

Google Project Zero says its Pixel 9 exploit chain moved from a zero-click context to Android root using only two exploits. The Dolby vulnerability affected Android broadly until its January 2026 patch, and the researchers are now examining whether a comparable chain can be built for Pixel 10.

AI agents are being applied to security work that takes action: testing codebases, exploiting vulnerabilities, assessing blast radius, and coordinating response. Cases from AWS, HackerOne, Wiz, and Cisco Talos illustrate the potential for speed—and the need for strict controls over identity, evidence, and execution.