RESEARCH

Research

Benchmarks, datasets, advisories and model documentation from zn. Each entry links to the method and the data behind it.

Research posts

Posts from the Research category of the blog. New posts appear here once they are published.

Six frontier models meet classic prompt injection, with and without a gatewaySeptember 2026
A 12 prompt pilot across six frontier models, direct and behind our gateway. What the models refused, what the gateway caught, and every number needed to reproduce it.

All research posts

Security advisories

Issues in software we ship, published with the same detail we ask of researchers: what happened, who is affected and what to do.

zn-gate agent hooks for Node.js 1.5.0 to 1.11.0: a protected file reached indirectly, or a command too long or slow to check, could be read or run without being checkedOctober 2026
GHSA-rccq-h3xc-j9qj · Fixed in: 1.12.0
zn-gate for Node.js 1.5.0 to 1.8.0: a crafted Codex CLI patch could write to protected files without being checkedOctober 2026
GHSA-f927-55cp-x265 · Fixed in: 1.8.1
zn-gate for Node.js 1.5.0 to 1.8.0: a crafted .env, .npmrc or .znrules file could make the secret scrubber time out and let tool output through unscrubbedOctober 2026
GHSA-9v62-q43j-crjm · Fixed in: 1.8.1
zn-gate for Node.js 1.5.0 to 1.7.0: a crafted shell command could make the agent hooks time out and let a protected file read run uncheckedOctober 2026
GHSA-2fg6-2frm-mr92 · Fixed in: 1.7.1
zn-gate scan for Node.js 1.4.0 to 1.7.0 could print secret values in its output and CI logsOctober 2026
GHSA-q5w2-m7j6-v464 · Fixed in: 1.7.1
zn-gate for Node.js before 1.6.0: an agent could run zn admin commands through a versioned package call, skipping the hook that denies themOctober 2026
GHSA-wvv2-f3m6-6wrq · Fixed in: 1.6.0
zn-gate 1.5.0 and earlier for Node.js on Windows: zn run could hand secrets to a program chosen through the environmentOctober 2026
GHSA-rf3f-ppm5-3xrx · Fixed in: 1.5.1
zn-gate 1.4.0 and earlier sent tool output and tool-call arguments to api.usezn.com without redaction when ZN_API_KEY was setOctober 2026
GHSA-r4h2-qcf2-8227 · Fixed in: 1.4.1

All advisories and the disclosure policy

Open data and models

Published on Hugging Face so you can check our results yourself.

Prompt injection benchmark dataset

zn-prompt-injection-bench: 23,699 rows under CC-BY-4.0, with the splits and audits documented in the dataset card.

Open on Hugging Face ↗

Galvanize 2 model card

Open weights (Apache-2.0), fine-tuned from Horizon-Labs/prompt-injection-guard-small. The card covers held-out results, method and known weak spots.

Open on Hugging Face ↗