How we work.

Reports answer one question from primary sources. Every factual sentence cites a document a reader can open, and every source carries a note on what it supports and what it doesn’t. Several add data we gathered ourselves, such as a tally of the federal health-breach portal and a trace of the Binance theft on the public ledger. Each report says what would change our view.

Studies are work we did ourselves: a static review of the published source of 50 MCP server packages, and a signed receipt format with an offline checker. Their code, data and limits are published here and on GitHub.

Experiment designs set out tests that could prove a report wrong. We publish them on one page before any result exists, while criticism can still change the design.

Every piece in the library has a label, such as Report or Static study. See what each kind of piece can claim and what it can’t.

Before we publish, a red-team pass opens every cited source and checks each claim against it. Numbers, dates, names and quotes have to match the source exactly. If a sentence goes beyond its source, we narrow it. The important claims in each report sit in our claims ledger, tied to their sources.

Then an AI reviewer reads the whole library with no context, as a skeptical security lead would, and lists the weakest passages. We fix what holds up and record what we changed.

We use AI models throughout our work to search for sources and draft text. They check claims against cited sources and read our drafts cold, as a hostile reviewer would. People choose the questions and decide what we claim. They sign off before anything is published.

A model’s output is never a source. Every claim cites a document you can open yourself, and a model that drafted a sentence doesn’t get to check it.

Brian D. Evans edits our research. He decides what we claim and signs off before anything is published. Each piece names him as its editor and stays signed by Lugano Labs.

He is Lugano Labs’ technical co-founder. He has made 144 commits to Hermes Agent, Nous Research’s open-source AI agent. On 4 November 2026 his GitHub profile showed 4,415 contributions in the past year, 3,809 of them in private repositories. He has worked with blockchain technology since 2013 and with AI since 2018.

He founded BDE Ventures and, in 2011, a digital and influencer marketing agency that grew into a top-25 Inc. 500 company in the marketing category.

Brian is the only name on this page, but he isn’t the whole team. Some of our researchers hold PhDs in AI, and some of our engineers came from frontier AI labs and other top companies in the field.

We keep their names off the site on purpose. By Binance’s account, its theft began with its engineers. The attackers knew one engineer’s role and who he worked with, and they reached another through a job site where his profile mentioned Binance. We review other companies’ security for a living, so we’re not going to hand attackers a list of ours.

If you’re a client or an investor, you can meet the people who’d do the work, under NDA, before anything starts.

Lugano Labs is the research lab of Lugano AI Holdings LLC, a US company. We study privacy, security and human control in AI. Our research is free to read, and every factual sentence links to a source you can open. We also build private AI products: Private Chat, Private Agents and Private API, all in private beta. Companies can ask us for independent security and privacy reviews of the systems they build or rely on. Researchers and funders can bring us an open question through Collaborate.

Lugano Labs also builds private AI products, which are in private beta. Our research doesn’t score or promote them. Where a report covers a market we sell into, it says so at the top. We are a member of NVIDIA Inception.

Our paid reviews for clients follow these rules. We take no paid work from a company while our published research scores its product. When we have a paid relationship with a company our research discusses, we disclose it on that piece. Clients never preview or veto research about them, and our reviews never recommend Lugano products.

We never use research data to build, tune or test a Lugano product. Research data means scan outputs, attestation evidence and materials from collaborators.

We tell that company first, in private. We publish once it has fixed the flaw or agreed, or after 90 days, whichever comes first.

If the issue is already public, we say we reproduced it, and we don’t wait.

We ask each company to credit Lugano Labs in its own advisory. To report a flaw in our work, see our security page.

What’s on this site on 4 November 2026, counted from the pages themselves.

• 16 research reports in our library, each built from primary sources.
• Data we gathered ourselves: a tally of the federal health-breach portal, a trace of the Binance theft on the public ledger, a scorecard of 17 private AI offerings and a scan of 50 MCP packages.
• Code and data for the MCP scan and the receipt checker, on GitHub.
• 384 entries across their reference lists. A source cited by two pieces counts twice.
• 279 claims in our claims ledger, each tied to the sources behind it.
• 19 dated entries in the corrections log below.

Most reports end with an experiment that could prove us wrong. We publish each design on our experiment designs page before any result exists.

Anyone can review our work. We log every correction and outside review below, with its date.

When we find an error, or someone shows us one, we fix it, date the change and list it here. Send corrections to contact@lugano.ai.

• 4 November 2026, all essays. We shortened every essay and checked each one again against its cited sources, with a separate AI reviewer for each. The entries below list the errors that check found in the published versions. Smaller fixes to wording and citations aren’t listed one by one. The homepage now gives each piece the date it was first prepared, as the piece’s own page does.
• 4 November 2026, AI defense. The 57.69% attack-success figure comes from AgentDojo’s Table 5, for GPT-4o against the authors’ strongest attack, and we hadn’t said so. We also described an exception in PACT’s design that isn’t one. The 2007 attack used crafted connection attempts, which the server then logged, and the summary lines now mark our view as ours.
• 4 November 2026, MCP source study. The scanner records eight kinds of marker, not five, and its secret-name pattern includes PASSWD. The rerun warning now covers both report columns that list hosts before review. A note on packages we removed by hand now cites the report, not the list of packages we kept, and a claim of our own no longer points to the report.
• 4 November 2026, Health records. The “biggest company” forecast was added by the person who shared a16z’s report, not made in it. The 95 percent appeal figure covers skilled-nursing denials in one inspector-general study and leans on UnitedHealth’s rate. Smaller points about the 23andMe sale, the Cassidy bill and a triage study are fixed too. HHS’s guidance covers records a clinic sends at the patient’s direction, which two summary lines had put as records the patient sends.
• 4 November 2026, Model reliability. Turpin and colleagues found that models systematically failed to mention the cue that swayed them, where we had said “in some cases”. The reinforcement-learning experiment used an earlier snapshot of Claude 3.7 Sonnet. The test section now says which result would count against our bet.
• 4 November 2026, Binance theft. Binance says its engineer searched for an AI coding tool and got a tampered Homebrew install. TRM’s and Elliptic’s totals differ mainly in coverage. The FBI’s advice on approvals didn’t support two controls we cited it for, and Hypernative’s counterfactual applies only where signing runs through its product. The summary lines now say what the ledger shows, that the hot wallet signed 50 authorizations; that Binance’s signing service produced them is our reading. The “largest theft on record” is now credited to TRM Labs and Chainalysis. The campaign is dated from June, as Binance dates it, not called five months long. Anthropic’s account now keeps that its attackers succeeded in a small number of cases, and Microsoft’s advice names a non-persistent virtual machine as one example of an isolated environment.
• 4 November 2026, Private AI verification. NCC Group’s review of Google’s design excluded the AMD platform and the phone apps, and we hadn’t said so. DDRop brought active interposer attacks to DDR5, which TEE.fail had already reached. Several vendor rows now carry notes we had left out. The NEAR row now credits its figure of eight H200 GPUs per node to NEAR’s documentation, where we had stated it as fact.
• 4 November 2026, Private information. RFC 6973 names nine privacy threats, not four. “Supply-chain attack” was our label for Peng and colleagues’ work, one leak path didn’t match their threat model, and CaMeL’s authors say it remains open to side channels.
• 4 November 2026, Agentic finance. RFC 9396 requires apps to protect payment details from tampering, where we had written “should”. AP2’s rejection-receipt rule and its open and closed mandates are now described as the specification states them.
• 4 November 2026, Prompt injection. CaMeL’s 77% against 84% is utility on tasks without attacks. BIPIA’s authors suspect two root causes, not one. CaMeL’s authors find it vulnerable to side channels.
• 4 November 2026, Agent trust. Our tests found several flaws in the archived v0.1 checker, not two. Anthropic’s figures come from its telemetry, which the summary lines now say, and benchmarks such as AgentDojo do score whether the requested task was done.
• 4 November 2026, Receipt essays. A v0.2 receipt carries no timestamp. The published v0.2 review record is a summary, its hashes and per-case results aren’t published, and the v0.2 READMEs now say so. The v0.1 review runner now ships with the sample files it needs. A one-time challenge proves freshness only when it is signed into the evidence.
• 4 November 2026, Breach analysis. Okta’s own timeline shows it had identified the 134 customers and Cloudflare before its first public notice, so only its 29 November update followed a reread of its logs. Cloudflare credits its access controls and firewall rules as well as hardware keys.
• 4 November 2026, Cheap inference. The “toxic waste” metaphor for personal data predates Devcon 8. Two comparisons across different measures are removed. Models can memorize personal data, and a sequence-level privacy guarantee protects a rare passage, not every person.
• 4 November 2026, Experiment designs. Three designs now match what their essays say would count against them: the model-reliability test names the comparison its essay relies on, the breach-analysis test counts a record that slows containment, and the private-verification test uses the error limits its reviewers set in advance. Shared rules now apply only where a design adopts them.
• 3 November 2026, MCP source study. We had described our sample as the 50 most-downloaded MCP server packages. The ranking file behind it recorded zero downloads for most candidates, many of them failed lookups, so that description was wrong. The study's counts still hold for the 50 packages we scanned. The study, its report and every essay that cites it now say so.
• 3 November 2026, receipt essays. Three essays said the receipt checker's source code and tests could be downloaded from this site. They can't. The essays now say what is published: the specification, the README and the internal review record. Since 4 November, the code, tests and fixtures are on GitHub, at Lugano-AI/signed-agent-receipt.
• 3 November 2026, privacy page. For about five hours the page said the site loads no analytics. Cloudflare Web Analytics was running. The page now says so.
• 3 November 2026, all essays. A check of every essay against every cited source corrected dates, attributions and figures, and narrowed claims that went beyond their sources.