San Francisco, California, USA, November 12th, 2026, CyberNewswire
Four-year cybersecurity study finds all 50 types of software and devices examined vulnerable, with 46 rated Critical or High risk.
nDiligence, Inc. today announced the release of Attack the Glass (ATG) research to the general public. The four-year study examines a cybersecurity vulnerability in how applications use people’s own devices to build what appears on screen, load data and run code while the application is in use. An attacker who exploits it can change what people see and what their software does, after every security check has passed. The research is free at https://atg.nDiligence.com.
Much of the software people rely on, from web browsers and mobile apps to vehicle displays, medical devices and industrial control screens, builds its user interface on the device while it is running, a process called runtime client-side rendering. The code, data and media it assembles come from dozens or hundreds of suppliers: the organization’s own systems, its vendors and their vendors.
An attacker who gains control of any one supplier gains placement and access inside the running application. Sign-in, encryption, Zero Trust, firewalls and code review all function before the code is loaded onto the device. Once loaded, the code is trusted, and nothing checks what it does. The attacker can change what appears on screen, capture what the person types and act with that person’s authority.
In February 2024 the domain behind Polyfill.io, a code library loaded by more than 100,000 websites, was sold to a company the U.S. Treasury later sanctioned. The altered code ran for months on visitors’ devices, and no automated security tool detected it; researchers found it that June. The underlying vulnerability was never fixed.
The ATG research documents how the same technique could deliver disinformation inside genuine news and election sites, show commanders and infrastructure operators a false picture, or hide safety alerts from selected users. Due to security concerns from this type of threat, the team behind nDiligence spent more than two years privately briefing governments before publishing.
“People trust what they see with their own eyes. In the modern world we are constantly looking at screens, and we have grown to trust applications, websites, devices and companies, assuming they have 100% control over what is shown to us,” said Robert Beckett, Founder and CEO of nDiligence, who led the four-year research into the ATG vulnerability. “ATG demonstrates how an attacker can hijack that trust without detection or attribution. A commander, a grid operator, a voter or a reporter can be looking at a screen that every security system says is safe, and what it shows can be manipulated. Whoever controls the screen can influence what people believe, decide and do, with sophisticated targeting. And right now, nobody can tell when or where it is happening. The cybersecurity community needs to understand this vulnerability so we can protect the integrity of software systems across industries, governments and critical infrastructure.”
Across the 10 categories examined, the research classifies five effects an attacker can achieve: deceive, disrupt, degrade, deny and destroy. All materials are free to share under Traffic Light Protocol (TLP) CLEAR, including a sixteen-chapter whitepaper, twenty online demonstrations and remediation playbooks.
“ATG was discovered during our research into digital supply-chain threats,” said Beckett. “Our team has spent more than 15 years working in online threat intelligence and countering influence operations, which is why we recognized how the ATG vulnerability could be exploited. Since 2024, we have been working with researchers, vendors and governments to find ways to close this gap. Anyone who builds, operates or defends systems that people use to make critical decisions needs to understand and mitigate the ATG vulnerability.”
About nDiligence
nDiligence, Inc. is a supply-chain intelligence company that builds trusted provider networks and keeps the supply chains beneath them under continuous watch. Its founders bring decades of experience in internet supply chains and in national security and intelligence systems. The ATG research was self-funded. Learn more at https://www.ndiligence.com/.
Contact
Chief Product Officer
Anna Patterson
nDiligence, Inc.
press@ndiligence.com
