Every manager faces the same situations before lunch: a message to land, a meeting to run, a hiring call, a report due. The AI Report built 37 Claude prompts for exactly those moments, organised by the situations every manager faces. 

Copy the prompt, fill the brackets, run it in Claude, and get back 10+ hours a week. Oh, and it's free. 

All you have to do is subscribe to The AI Report, a 5-minute daily AI brief read by 400,000+ business leaders at IBM, AWS and Microsoft, and the full prompt pack lands in your welcome email. The newsletter and the prompts, both free. Subscribe and grab both

Subscribe and get 37 prompts free

Dear Sentinels

Scyther is an automated formal-verification tool for security protocols, courtesy of Cas Cremers. What sets it apart is its knack for analysing protocols with an unbounded number of sessions and nonces, rather than just a handful of runs. Instead of checking a protocol in one fixed scenario, Scyther can whip up a tidy summary of all its possible behaviours, and it does this with impressive efficiency compared to its peers. Over the years, it has been put through its paces on heavyweight protocol suites like IKEv1 and IKEv2, not to mention the ISO/IEC 9798 family of authentication protocols. It has even helped uncover new multi-protocol attacks, which is always a fun day at the office. The project is still very much alive and kicking, with the latest stable release (v1.3.0) arriving in February 2026. If you fancy a poke around the code or want to contribute, you’ll find it all on GitHub.

But before we get too carried away, let’s see what the World Wide Web has delivered to our digital doorstep this week.

The Scyther Tool

How an AI-Native Engineering Team Does Code Review

How to Actually Run Your Coding Agent Safely (And Avoid the Horror Stories)

Google's "Frozen v2" chip reportedly bakes Gemini's architecture directly into silicon for efficiency gains

AI is more likely than humans to form biases when hiring

Google preparing Gemini Live and Skills for web rolloutMeet GPT-Red: an LLM super-hacker OpenAI built to make its models safer

These days, with everything and everyone plugged into the Internet, making sure our security protocols actually do what they claim has never been more important. Gone are the days when a quick once-over by a clever human was enough to spot the holes. In fact, history is littered with protocols that looked fine on paper, only for someone to spot a gaping flaw after they’d already been rolled out everywhere. The problem is, there are just too many possible ways things can go wrong in a real network, with attackers trying every trick in the book. It’s simply too much for even the sharpest minds to keep track of.

Because humans can’t keep up, we’ve had to turn to formal methods and automated tools to do the heavy lifting. Tools like ProVerif and Avispa showed us that it’s possible to catch attacks or prove things are safe, at least within certain logical models. They made formal verification a bit less terrifying, even if it’s still not exactly light reading. Scyther came along with a focus on speed and ease of use, making it a great starting point for researchers and students alike. Of course, if you want the gold standard of assurance or need to catch the really sneaky attacks, you’ll probably end up with something like Tamarin Prover, which is as friendly as a maths textbook on a Monday morning.

Scyther’s real charm is that it’s a push-button tool. You don’t need to be a logic wizard to use it, but you still get the benefits of proper mathematical analysis. It was built with both researchers and students in mind, aiming for a sweet spot between accessibility and speed. Thanks to its clever way of exploring the state-space, even those who aren’t experts in symbolic logic can check how sturdy their protocols are. Sure, its analysis might seem a bit rough compared to the latest and greatest, but for small to medium-sized protocols, it’s still lightning fast. Most checks finish before you’ve had time to make a cup of coffee.

The real magic under Scyther’s bonnet is its pattern refinement algorithm. Instead of drowning in an endless sea of possible protocol runs, it sorts them into neat patterns, making the impossible suddenly manageable. This means Scyther can check protocols for an infinite number of sessions, which is rather impressive. Where other tools might get stuck and never finish, Scyther keeps things sensible by capping the pattern size. As a result, it gives you a clear answer about eighty per cent of the time, either proving things are safe or finding a problem. For the trickier cases, it falls back to checking a fixed number of runs, so you still get something useful even if it can’t do the whole lot.

To get your protocol into Scyther, you’ll need to use the Security Protocol Description Language, or SPDL for short. Think of it as the translator between your brilliant ideas and the tool’s inner workings. If you’ve ever dabbled in C or Java, the syntax will look pleasantly familiar, so you won’t be lost for long. In an SPDL file, you spell out the protocol by defining roles and the exact order of events, like who sends what to whom. You can also set up global declarations for the fancy cryptographic stuff, such as using the inverse keys command to link up public and private keys.

When you’re writing SPDL, you’ll be juggling terms like agent names, constants, and the occasional encrypted pair. The key thing is to tell Scyther which values are freshly made-up (nonces) and which are just variables for storing received info. To help Scyther run faster and avoid chasing after imaginary attacks, you can define usertypes, which basically tell it what sort of messages a variable can hold. There are also some handy tricks in the language, like the bang prefix (!) for labels, which lets you hush up warnings when you’re modelling direct chats with the adversary. By describing each role in detail, you make sure every message sent has a matching one received, which is the backbone for setting up your security requirements.

It’s absolutely crucial to spell out your security claims. If you don’t, Scyther has nothing to check and just sits there simulating things for fun. In Scyther, you pop these claims straight into the role specifications, and they become the official rules your protocol has to follow. By doing this, you set out exactly what should stay secret and who should be talking to whom, like making sure a nonce doesn’t end up in the wrong hands or that your communication partner is actually who you think they are.

Scyther can check all sorts of claims, from basic secrecy to the more complicated bits of the authentication hierarchy, like aliveness, weak agreement, and non-injective synchronisation. It gets quite clever with agreement checks, using Commit and Running signals to see if both sides are really on the same page. For example, a responder’s Commit needs a matching Running from the initiator over the same data, or it’s back to the drawing board. If you’re in a hurry, Scyther can even auto-generate standard claims for you, so you can get a quick sense of whether your protocol is up to scratch before diving into the nitty-gritty details.

Scyther’s results interface is where you find out if your protocol is a hero or a villain. Once it’s done crunching the numbers, you’ll see a Status column with either Ok or Fail, and another column telling you if it’s Verified or Falsified. Verified means you’ve got a formal proof for any number of runs, while Falsified means Scyther has found a definite problem. If it hits its search limit without finding anything nasty, it’ll just say no attacks were found within those bounds. This is handy for deciding if your protocol is good enough for the job, or if you need to bring in the big guns like Tamarin.

If Scyther finds a problem, it doesn’t just leave you guessing. It gives you a visual attack graph, all based on the Dolev-Yao attacker model, where the intruder can do anything except break the crypto. In these graphs, orange nodes show what the attacker is up to, like encrypting, decrypting, or rerouting messages, while bold green arrows are the honest agents just trying to get on with their day. By following the arrows and nodes, you can spot exactly where things went wrong, whether it’s a reflection attack or a classic man-in-the-middle. It’s like detective work, but with more arrows.

In the real world, security protocols rarely get to live in splendid isolation. They have to play nicely with others, and sometimes that’s where the trouble starts. Scyther lets you check how different protocols interact, so you can spot if an attacker might use one protocol to mess with another. You do this by running protocol descriptions in parallel, looking for sneaky vulnerabilities that only show up when everything’s running at once. This used to be a nightmare because of the sheer number of possibilities, but Scyther’s speed means you can often just stick your protocol files together and see what happens.

If you’re dealing with fancy cryptographic tricks like Diffie-Hellman or bidirectional symmetric keys, Scyther has you covered (well, mostly). It works mainly with syntactic equality, but you can model these clever operations using helper protocols, marked with an @ in SPDL. These helpers let the attacker learn equivalent terms, which is a neat way to approximate the real maths without giving yourself a headache. Scyther even tidies up the attack graphs by collapsing nodes, so you don’t need a magnifying glass to follow what’s going on. All in all, it’s a handy tool for anyone designing security protocols, whether you’re teaching the next generation or just trying to break your own work before someone else does.