Labs
[about]

Parameter Labs

Parameter builds AI agents that test software the way an attacker would: live web apps, APIs and the code behind them, continuously rather than once a year. Labs is where we write down what they find.

Every post starts with something real: a finding our agents proved, a pattern that keeps turning up across thousands of tests, or a lesson from building the agents themselves. We only write about a vulnerability once it is fixed and the people affected have had time to act.

We show our work. Each post carries the numbers behind it (how many tests ran, what landed, how long the fix took) and the evidence, so you can see exactly where the line gave it away. If we can't prove it, we don't publish it.

Most posts end with something your team can check this week: a test to run, a question to ask, a pattern to search your own code for.

The Parameter teamWritten by the engineers and researchers building Parameter.

parameter.aiBook a call
Do the Math: How We Took Over ChatGPT AccountsBy bypassing ChatGPT's sandbox and content security policy, our research team was able to take over anyone's account simply by sending them a link.Oct 28, 2026

Parameter Labs

Research and engineering notes from Parameter. What our AI agents find when they test live apps and code, how we prove it, and what we learn building them.

We write up findings once they are fixed, with the numbers behind them: how many tests ran, what landed, and which kinds of bug keep coming back. Most posts end with something your team can check this week.

Written by the people building Parameter.

Four bugs in four hours, and the sentence doing all the workOn the same day, an agent found four pre-auth bugs in thirty-year-old control software and Anthropic published five full exploit chains. Read the fine print in both and the model is not the story.
Field noteOct 26, 20264 mins
PHP2Shell: the embargo lost to the clockA coordinated disclosure assumes the bug is hard to find. PHP2Shell was re-found overnight by at least two other teams, and the exploit was on the wire four days before the patch.
Field noteOct 22, 20264 mins

All posts

  • All topics4
  • Research4
  • Engineering0
  • Product0
  • Company0
Do the Math: How We Took Over ChatGPT AccountsBy bypassing ChatGPT's sandbox and content security policy, our research team was able to take over anyone's account simply by sending them a link.
Oct 28, 202612 mins
Four bugs in four hours, and the sentence doing all the workOn the same day, an agent found four pre-auth bugs in thirty-year-old control software and Anthropic published five full exploit chains. Read the fine print in both and the model is not the story.
Field noteOct 26, 20264 mins
PHP2Shell: the embargo lost to the clockA coordinated disclosure assumes the bug is hard to find. PHP2Shell was re-found overnight by at least two other teams, and the exploit was on the wire four days before the patch.
Field noteOct 22, 20264 mins
Loud, messy, and root in secondsThe agent that breached DIVD commented its own scripts, broke its own man-in-the-middle, and still went from a hijacked helpdesk session to root before anyone could read the logs. It did not need to be good.
Field noteOct 7, 20263 mins