Google Project Zero says its Pixel 9 exploit chain moved from a zero-click context to Android root using only two exploits. The Dolby vulnerability affected Android broadly until its January 2026 patch, and the researchers are now examining whether a comparable chain can be built for Pixel 10.

AI agents are being applied to security work that takes action: testing codebases, exploiting vulnerabilities, assessing blast radius, and coordinating response. Cases from AWS, HackerOne, Wiz, and Cisco Talos illustrate the potential for speed—and the need for strict controls over identity, evidence, and execution.

The keyv/cacheable investigation is a reminder that a compromised npm dependency can spread through transitive resolution, not just direct imports. Teams need to scope exposure from build evidence and deployed artifacts.