Research Brief 003
One Chain: Disclosure and Accountability in AI Commerce
Two original audits examine how disclosure and accountability travel from AI-generated advertising to product recommendations and checkout.
Program I
Responsible AI
Accountability · deployment · oversight · emerging technologies
Selected publications
Searchlight 028
The First Head Start Is Over: AI Cyber Defense Now Depends on Who Obtains Access
An open-weight model now builds exploits at the level AI labs restricted in April. Defensive advantage depends on access to private programs and on how fast fixes reach production.
View the Searchlight 028 figure and sources
Figure 1
Attackers weaponize new flaws in under a day. Defenders’ median time to fully patch them is 43 days, and rising.
Two clocks from different datasets, drawn separately because they measure different intervals
Attacker clock · Median time from discovery of a vulnerability in the wild to weaponization
Under 1 dayMicrosoft Digital Defense Report 2026 · July 2025 to June 2026 · reported as “well below 24 hours”
Defender clock · Median days to fully patch a known exploited vulnerability
Share of known exploited vulnerabilities fully remediated fell from 38% to 26%.
Note: Microsoft and Verizon use different datasets and reporting periods, so the two clocks should not be read as a ratio. Microsoft gives its figure as a ceiling. Verizon’s 2026 report covers activity in 2025.
Sources: Microsoft Digital Defense Report 2026, as reported by Help Net Security; Verizon 2026 Data Breach Investigations Report, as reported by CyberScoop.
Searchlight 027
Companies Blaming AI for Layoffs Will Have to Say So on the Record
Searchlight 026
Who Gains and Who Pays When AI Labs Agree to Slow Down
Research in progress and program context
Horizon Scan 001, AI Governance in Regulated Industries. The AI Governance Pulse and the Governance Readiness Assessment, both published as open-methodology tools. Research Briefs on financial-sector and healthcare AI governance. Track II working sessions on cross-jurisdictional regulatory convergence.
Image credits
- Responsible AI
- Human/robot teaming. Image: S. Bagchi/NIST.