Kiri Blog

Why is everyone suddenly putting AI agents in a box?

Precious Okwu — Tue, 27 Oct 2026 00:00:00 GMT

A year ago, AI coding tools suggested code. You read it and decided whether to run it.

Now they run it. They install packages, execute tests, call APIs and open pull requests, while reading text from strangers: README files, GitHub issues, web pages. Usually with the same access as the engineer who started them.

What is an agent sandbox?

Agent sandbox

A boundary around an AI agent that controls what it can read, run and reach.

Inside the boundary, the agent can work freely: edit the project, run the tests, install what it needs. Outside it are the things it should never touch on its own: your SSH keys, your cloud credentials, other repositories, and most of the internet.

What changed

BeforeAI suggests code. It writes, and a person decides what executes.

NowAI runs the code. A sandbox decides what it can read, run and reach.

That shift is why agent sandboxes have gone from a niche security topic to something every team running agents needs to understand. A permission prompt on every command doesn’t scale: after the fortieth one, nobody reads them.

What this series covers

Starting Friday, two short parts a week. Each one stands on its own, with three diagrams:

What an agent can reach without a sandbox, and how one poisoned README leaks your keys
Why git worktrees aren’t isolation
Containers, gVisor and microVMs, and what actually separates them
The network wall, secrets, many agents at once, and a reference architecture to finish

No vendor pitches. Just how it works. If there’s something you want covered, tell us and we’ll fold it in.

Review the Dockerfile your agent wrote

Precious Okwu — Tue, 27 Oct 2026 00:00:00 GMT

Ask a coding agent to containerise an app and you get a Dockerfile in seconds. It builds. It runs. In review, it’s easy to skim: it’s eight lines, and the app works.

The trouble is where models learned to write Dockerfiles: tutorials and quick-start READMEs, written to get something running, not to ship. The same few shortcuts turn up again and again.

The six checks

1. Is the base image pinned? node:latest today is a different image next month. Pin a version and its digest: FROM node:22-slim@sha256:…. docker buildx imagetools inspect node:22-slim prints the digest. Dependabot or Renovate can keep it current, through pull requests you review.

2. What does COPY copy? COPY . . takes everything in the folder, including .env, .git and whatever the agent left lying around. Copy named paths, and add a .dockerignore:

.env*
.git
node_modules
*.pem

3. Are there secrets in ENV or ARG? Both are saved in the image. Anyone who can pull it can read them with docker history or docker inspect, even if a later step “removes” them. Pass runtime secrets when the container starts (--env-file, or your platform’s secrets). For build-time secrets, use a secret mount, which never lands in a layer:

RUN --mount=type=secret,id=npm_token \
    NPM_TOKEN=$(cat /run/secrets/npm_token) npm ci

4. Is anything piped to a shell? curl … | sh runs whatever that URL serves on the day you build. Install from a package manager, or download a pinned version and check its checksum.

5. Does the install use the lockfile? npm install can resolve newer versions than the ones you tested. npm ci installs exactly what package-lock.json says, and --ignore-scripts stops install scripts, a favourite place to hide malware. For Python, pip install --require-hashes -r requirements.txt does the same job.

6. Who does it run as? With no USER line, the app runs as root inside the container. Add USER with a non-root user, or start from an image that already has one.

After review

Put together, the fixes usually mean two stages: one that builds with all the tools it needs, and a small final image that has only the app. No shell, no package manager, nothing for an attacker to work with.

You don’t have to build minimal base images yourself. Distroless, Chainguard and Docker Hardened Images (free and open source since December 2025) all ship images without a shell or package manager, with a software bill of materials, and with non-root variants.

Make the agent get it right

Reviewing the same six things on every pull request gets old. Two cheaper fixes:

Tell the agent. Add the six rules to your AGENTS.md or CLAUDE.md, the file the agent reads in every session. It will follow them far more often than it guesses them.
Check it in CI. hadolint flags most of these in the Dockerfile itself, latest tags and missing pins included. Trivy or Grype then scans the built image for known vulnerabilities. A failing check catches what a tired reviewer won’t.

A file in your Downloads folder can hijack your coding agent

Precious Okwu — Tue, 27 Oct 2026 00:00:00 GMT

Last week, a coding agent on a developer’s laptop tried to install a known-malicious npm package. Nobody typed the command. A text file did.

The file was called AGENTS.md, and it was sitting in the developer’s Downloads folder. Forever Security, who caught it, published the details on 22 October. There was no bug and no exploit. The agent did exactly what it was built to do.

What happened

Coding agents such as Codex and Claude Code read an instruction file from the folder they start in: AGENTS.md, or CLAUDE.md for Claude Code. It is how a project tells the agent its conventions: how to run the tests, which package manager to use. The agent treats it as guidance from you.

A file lands in Downloads. Forever could not tell how this one got there. In their tests, an ordinary web page saved a file named AGENTS.md into ~/Downloads with no prompt in Chrome, Edge or Firefox. Brave asked first.
A developer starts an agent in Downloads. This is more common than it sounds: you download something, open a terminal there, and ask the agent to look at it. Forever counted more than 1,300 Claude Code sessions started from Downloads across its customers.
The agent reads the file as instructions. It was dressed up as engineering notes. One section told the agent to add a server to its own configuration and install a package called function-color.
The agent runs npm install function-color. That package is linked to a malware campaign Forever calls MALFEX. The install would have run with the developer’s shell, files and credentials.

Forever blocked the install before any code ran. npm has since replaced the package with a security placeholder.

How well it works

Forever then tried it on purpose, with harmless payloads.

Codex followed the planted instructions in about 90% of attempts. Their payload opened the calculator.
Claude Code, given a malicious CLAUDE.md, sent its API traffic to a server the researchers controlled in roughly half of their runs. That exposed the login token and let the fake server send back its own tool calls. Reports differ on the details here, so treat this number as rougher than the Codex one.

Neither vendor had commented in the coverage we found.

Why there is nothing to patch

Reading instruction files is a feature. So is running shell commands. The weakness is the combination: an agent that trusts any file in its working folder and acts with your full permissions.

The same pattern shows up anywhere an agent reads text a stranger wrote: a README in a cloned repo, a GitHub issue, a web page it fetches. Downloads is just the easiest place to drop the text, because browsers write there for you.

What to change today

These take minutes and work with any coding agent.

Start agents in a project, never in Downloads or your home folder. Open the terminal at the root of the repository you mean to work on. If you need the agent to look at a download, move the file into a project first.

Answer “no” to folder trust prompts you didn’t expect. Some agents ask whether you trust the files in a new folder before loading them. That question is the defence against this attack. Don’t approve it for Downloads, Desktop or your home folder.

Read unfamiliar instruction files before the agent does. In a repo you just cloned, open AGENTS.md, CLAUDE.md and similar files and look for anything that installs packages, adds servers or changes settings.

Keep approval prompts and the sandbox on. Modes that skip every confirmation remove the last point where you would have seen npm install function-color go by. If your agent has a sandbox, turn it on: Claude Code has /sandbox, and Codex runs commands in a sandbox unless you switch it off.

Stop install scripts by default. Many malicious packages run their payload from an install script. This turns them off for npm on your machine:

npm config set ignore-scripts true

Some packages genuinely need their scripts. Run those installs on purpose, in a project you trust.

Check whether you were hit

Look for stray instruction files in the places agents shouldn’t start:

find ~/Downloads ~/Desktop ~ -maxdepth 1 \( -name AGENTS.md -o -name CLAUDE.md \)

Look for the package in projects you work on (change ~/code to where yours live):

grep -rl --include=package-lock.json function-color ~/code

The planted file told the agent to add a server to its own configuration, so check that list for anything you don’t recognise: ~/.codex/config.toml for Codex, and ~/.claude.json or a project’s .mcp.json for Claude Code. Also check that ANTHROPIC_BASE_URL and OPENAI_BASE_URL are unset, or point where you expect, both in your shell and in the agent’s settings.

If anything turns up, assume the agent’s credentials were exposed. Log out of the agent and log back in, and rotate any tokens that machine could reach: npm, GitHub, cloud keys.

The longer fix

The tips above depend on people remembering them. The durable fix is a boundary the agent can’t talk its way out of: a sandbox that decides which files it sees, which addresses it can reach, which credentials it holds and what it can push. With that in place, a bad instruction file becomes a failed command instead of a stolen token.

That is what our series on agent sandboxes is about. Part 1 explains what a sandbox is and why every team running agents now needs one.

Sources: Help Net Security, The Hacker News, RuntimeWire.

How a container gets a GPU

Precious Okwu — Tue, 27 Oct 2026 00:00:00 GMT

Almost every AI workload you run in a container wants a GPU: serving a model with vLLM, fine-tuning with PyTorch, running llama.cpp. But a container is just a process with a fenced-off view of the machine, and nothing about that view includes a graphics card. So how does the card get in?

Two halves of a driver

A GPU driver comes in two halves. One half lives in the host’s kernel. The other is a user-space library, libcuda.so, that programs load to talk to it. The two must come from the same driver release.

That rules out putting the driver in the image. The image can’t know which driver the host runs. So the work is split:

The image brings CUDA: the toolkit libraries your framework was built against, such as cuBLAS and cuDNN.
The host brings the driver. When the container starts, the NVIDIA Container Toolkit adds the device files (/dev/nvidia*) and mounts the host’s copy of libcuda.so into it.

You ask for this with one flag:

docker run --rm --gpus all nvidia/cuda:12.6.3-base-ubuntu24.04 nvidia-smi

If that prints your card, the plumbing works. Newer setups describe the same devices and files in a CDI spec, a small file that Docker, Podman and containerd can all read, so the runtime doesn’t need NVIDIA-specific code.

The version rule

Because the driver comes from the host, the host sets the ceiling. An image built for a newer CUDA than the host driver supports fails at start-up, usually with “CUDA driver version is insufficient”. nvidia-smi on the host shows the highest CUDA version its driver supports. Pick images at or below it.

This is why the same image can work on your workstation and fail on a cloud node: different machines, different drivers.

The part that runs as root

The toolkit is the piece that reaches into the host to wire each container up, so it runs with the host’s privileges. Its bugs are container escapes. In July 2025, Wiz disclosed NVIDIAScape (CVE-2025-23266): an image could set one environment variable and get the toolkit’s start-up hook to load the attacker’s library, as root, on the host. Version 1.17.8 fixed it.

Two habits follow. Keep the toolkit and GPU Operator updated like you would the kernel. And don’t run images you don’t trust on a GPU host that other people’s workloads share.

GPUs are expensive, so teams pack several containers onto one. There are three ways to do it, and they differ in one thing that matters: whether the tenants can see each other.

Time-slicing gives each container the whole card in turns. Easy, but memory is shared and nothing keeps one tenant out of another’s work.
MPS runs several processes on the card at once through one server. Better use of the GPU, still shared memory.
MIG splits a data-centre card (A100, H100 and newer) into hardware slices, each with its own memory. It is the only one of the three you should treat as a boundary.

On Kubernetes, the device plugin hands out whole GPUs (nvidia.com/gpu: 1). Dynamic Resource Allocation, stable since Kubernetes 1.34, lets a pod ask for a GPU by its properties instead, such as memory or model. That is the path to sharing schemes like MIG without hand-labelling nodes.

And on a Mac?

There’s no NVIDIA card, and the Linux VM that every Mac container runtime uses can’t see the Apple GPU through Metal. Podman’s libkrun backend gets part of the way: it passes Vulkan compute through to the host GPU, which llama.cpp can use. One user measured it at about 40% slower than running natively, but well ahead of CPU-only. Most Mac tooling for local models runs the model on the host instead and keeps containers for everything around it.

Run your MCP servers in a box

Precious Okwu — Tue, 27 Oct 2026 00:00:00 GMT

MCP servers are how coding agents get tools: GitHub, a database, a browser, your files. Adding one is a line in a config file, usually something like npx some-mcp-server. That line starts a program on your machine, as you.

What that program can reach

An MCP server started with npx or uvx runs with your user’s permissions. It can read your SSH keys and cloud credentials, see every environment variable the agent was started with, read any file you can, and connect anywhere on the internet. It needs none of that to list your GitHub issues.

This has already gone wrong. In September 2025, a popular npm package called postmark-mcp, which let agents send email, shipped an update that quietly blind-copied every message to an outside address. Researchers at Koi Security spotted it, and the package was pulled from npm. A flaw in mcp-remote, a widely used helper, let a malicious server run commands on the developer’s machine (CVE-2025-6514, rated 9.6). Dozens more MCP vulnerabilities were reported in the first half of 2026.

Boxing one server by hand

Most MCP clients only need a command that speaks MCP over standard input and output. docker run -i is such a command. Here is GitHub’s official server in Claude Code’s .mcp.json:

{
  "mcpServers": {
    "github": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "--read-only", "--cap-drop=ALL",
        "--security-opt", "no-new-privileges",
        "--memory", "512m",
        "-e", "GITHUB_PERSONAL_ACCESS_TOKEN",
        "ghcr.io/github/github-mcp-server"
      ],
      "env": { "GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_TOKEN}" }
    }
  }
}

What each part buys you:

-i --rm: talk over stdin and stdout, and throw the container away when the session ends.
No -v mounts: the server can’t see your home folder. If it needs files, mount one folder, read-only: -v "$PWD/docs:/docs:ro".
-e with one name: the container gets that one token, not your whole environment.
--read-only --cap-drop=ALL --security-opt no-new-privileges: it can’t modify its own image or gain privileges.
--network none for servers that work only on local files, such as a filesystem or SQLite server.

Pin the image by digest (ghcr.io/github/github-mcp-server@sha256:…), so an update reaches you only when you choose it. That alone would have stopped a postmark-mcp-style update.

Many servers: a gateway

Once you have five servers, five blocks of docker run flags get unwieldy. A gateway is one MCP server that fronts all the others. Your client connects to it once. It starts each real server in its own container when a tool is first called, hands each one only its own secret, and logs every call.

Docker’s MCP Gateway works this way: secrets are set with docker mcp secret set and injected only into the container that needs them. The log matters as much as the isolation. When an agent does something odd, you can see which tool it called, with what.

What the box doesn’t fix

A container limits what a server can reach. It doesn’t limit what the server is allowed to do with the access you gave it. A GitHub token that can delete repositories still can, from inside a container. So:

Give each server the smallest token that works: a fine-grained, read-only token for a server that only reads issues.
Treat tool output as untrusted text. A server that fetches web pages or issues can hand your agent instructions written by a stranger. That is a prompt-injection problem, and no container solves it on its own.

Security roundup: 19–25 October 2026

Precious Okwu — Mon, 26 Oct 2026 00:00:00 GMT

Last week was busy enough that some trackers started calling it “Black October”. Here is what matters if you write and ship software, most urgent first.

A note on sources: much of this week’s coverage comes from vendor blogs and incident trackers rather than the affected companies. Every item links to where it was reported. Before you act on a version number or a deadline, check the vendor’s advisory or CISA’s catalog.

Supply chain: the one developers should read first

LiteLLM was poisoned on PyPI and Docker Hub (21 October)

Attackers published a malicious LiteLLM 1.107.0 to PyPI and Docker Hub. It carried an info-stealer aimed at cloud credentials, AI provider keys and developer secrets, and sent them to a server the attackers controlled. The bad release was on PyPI for about an hour and three quarters, from roughly 11:40 to 13:23 UTC.

The GitHub tag for v1.107.0 was clean. That means the attackers got into the release pipeline, not the source code, so reading the code on GitHub would not have shown anything wrong. As of 25 October, how they got in was still being investigated. (Aviatrix, Shattered)

If you installed 1.107.0, or pulled that image, during that window: treat every secret on that machine or CI runner as stolen. Rotate cloud credentials, AI API keys and tokens, then pin to a known-good version.

The pattern: hijacked releases, not lookalike packages

Two days earlier, five OVHcloud CLI releases were reportedly swapped for builds that steal secrets (AgentBeam tracker). One weekly review calls the campaign the first publicly attributed large-scale supply-chain attack driven by agentic AI (Shieldworkz).

The common thread is that attackers take over a real maintainer account or release pipeline instead of publishing a package with a similar name. Checking the package name doesn’t help when the name is right. What helps:

Pin exact versions and commit lockfiles.
Install in CI without lifecycle scripts where you can (npm ci --ignore-scripts).
Keep long-lived secrets off the machines that install dependencies.

Exploited right now: patch these first

These are on CISA’s Known Exploited Vulnerabilities list, which means attackers are already using them.

Product	CVE	What it is	Status
Arista VeloCloud Orchestrator (on-premises)	CVE-2026-114625	SQL injection, CVSS 9.9	Disclosed 22 October and added to the list 23 October. The federal deadline to patch is 26 October.
BeyondTrust Remote Support	CVE-2026-102764	Zero-day	Flagged as the most urgent item of the week (briefing)
Ivanti Connect Secure	CVE-2026-104935	Authentication bypass	Added 13 October and still being exploited

Critical bugs to patch

Node.js (advisory, 21 October): security releases for 22.x, 24.x and 26.x fix two bugs:
- DNS resolution silently cut short hostnames that contain a NUL byte;
- the HTTP Agent reused connections when it shouldn’t have.
Brotli decoder (CVE-2026-111497): an out-of-bounds write in versions 1.0.3 to 1.2.0. It was first disclosed for Node.js as “Node2Shell” and has since reached Python packages. Check what bundles a Brotli decoder in your dependency tree, not just your direct imports. (HN digest)
GitLab: a vulnerability rated CVSS 10.0 (Shieldworkz).
PHP: two critical remote code execution flaws (same source).
Dell: five flaws in Dell System Update, one of which lets an unauthenticated remote attacker run code as root (eSecurityPlanet).
Certificates: a compromised certificate authority was reported, and an eMudhra certificate key-generation flaw was discussed on Hacker News.

AI coding agents are now a target

A malicious instruction file sitting in a developer’s Downloads folder tried to make their AI coding agent install a known-malicious npm package (HN digest).

No exploit was needed. The attack only needs an agent that reads files it was never meant to trust and then runs commands with the developer’s permissions. It is the clearest real-world case so far for running coding agents in a sandbox, with limits on:

which files the agent can read and write;
which network addresses it can reach;
which credentials it can see.

Many agent tools ship such a sandbox, often turned off by default (guide).

Ransomware and breaches

Most of these are claims posted on ransomware groups’ leak sites and have not been confirmed by the victims.

Qilin listed:
- the US law firm White & Case on 25 October (HookPhish);
- SLTN Inter Access in the Netherlands on 24 October (HookPhish);
- Aryza on 23 October (HookPhish).
N0n claimed:
- the health insurer Asisken Asistencia Médica, listing 139,006 client records with diagnosis codes (HookPhish);
- Texcar in Dallas, with tax records that include Social Security numbers (HookPhish).
Earlier in October (SharkStriker):
- ransomware forced the cloud provider IDCF Frontier to shut down, affecting 495 companies and local governments;
- Daiwa Securities reported more than 110,000 client records exposed;
- Skyticket reported 14.64 million records exposed.

This week’s checklist

Search lockfiles, images and CI logs for litellm==1.107.0 and the OVHcloud CLI. If you find either, rotate every secret that machine could reach.
Update Node.js on every supported line.
Find and update anything that bundles a Brotli decoder between 1.0.3 and 1.2.0.
If you run Arista VeloCloud Orchestrator on-premises, BeyondTrust Remote Support or Ivanti Connect Secure, patch now and look for signs of compromise.
Turn on your coding agent’s sandbox, and stop it from reading folders like Downloads.

What's hot: agent sandboxes, Claude Fable 5.1 and TypeScript in Rust

Precious Okwu — Mon, 26 Oct 2026 00:00:00 GMT

Three things dominated developer conversation this month: sandboxes for AI agents, a new round of Claude models, and JavaScript tooling being rewritten by agents. Here is what happened, with links to where it was reported, and what we think it means.

Agent sandboxes became infrastructure

Running agent code in isolation recently stopped being a niche idea. This month, money, open-source projects and standards bodies all moved at once.

Money: Daytona reportedly raised a $60 million Series B at a $1 billion valuation to build cloud infrastructure for short-lived, stateful agent jobs.
Open source:
- AWS released Strands Box in developer preview (Help Net Security). It combines operating-system isolation with rules that look at what an agent has already done before letting it run a command or call an API. It runs on Apple-silicon Macs, with Linux support planned.
- Kubernetes SIG Apps has an Agent Sandbox project that adds a Sandbox resource for untrusted agent code, using gVisor or Kata Containers underneath.
Standards: the Agentic AI Foundation took on Alibaba’s OpenSandbox, alongside Anthropic’s Agent Skills, OpenAI’s Open Responses and Hugging Face’s OpenEnv (AI Agents News).
The platforms: a ranking published on 9 October lists six hosted options: Northflank, E2B, Modal, Daytona, Together Code Sandbox and Vercel Sandbox (Northflank; see also Modal and Cosmonic). They split into two camps:
- Firecracker microVMs, where each sandbox gets its own small VM (E2B, Vercel);
- gVisor and similar, where a user-space kernel sits between the code and the real one (Modal, and Northflank depending on configuration).
On your own machine: coding agents now ship sandboxes too. Claude Code’s /sandbox wraps shell commands with macOS Seatbelt, or bubblewrap on Linux and WSL2. It’s off by default (guide).

Why it matters. The same week, a malicious instruction file in a developer’s Downloads folder tried to make their coding agent install a malicious npm package (see this week’s security roundup). An agent with your shell and your credentials is only as safe as the files it reads. A sandbox has to limit four things: which files the agent sees, which addresses it can reach, which credentials it holds, and what it can push to git.

Our take, as people building a container runtime. An agent sandbox is a container problem with harsher rules:

it has to start in milliseconds, because agents start thousands of them;
it has to keep state between steps;
it has to treat the code inside as hostile, not just buggy.

That is why the microVM approach keeps winning, and it’s the design space Kiri works in. We’ll go deep on it in a later post.

Claude Fable 5.1 and Opus 5.5: agent loops got cheaper

Claude Fable 5.1 launched on 1 September (MacRumors, VentureBeat):
- a 1 million token context window and up to 128,000 output tokens;
- cache reads 75% cheaper, while base prices stayed the same;
- Anthropic says Claude Code users should see about 60% fewer cybersecurity false positives;
- generated text carries an invisible watermark, with a detection API in preview;
- a sibling model, Claude Mythos 5.1, has lighter safeguards and is limited to vetted security and life-sciences users.
Claude Opus 5.5 followed on 22 September. Reports describe it as close to Fable 5.1 on most tasks at about 40% lower cost than Opus 5 (technews.tw, Vals AI).

Why the cache price matters most for agents. An agent loop sends the same long prefix on every step: system prompt, tool definitions and the conversation so far. Only a little is new each time. Most of the input tokens in a long agent run are therefore cache reads, and that’s the part that just got 75% cheaper. One outlet estimates typical workloads cost about 25% less, and highly agentic ones up to 45% less. We haven’t measured this ourselves yet, and the real saving depends on how well your prompts are cached.

JavaScript: TypeScript in Rust, and a quieter week for Node and Bun

Cloudflare announced a Rust port of TypeScript, described as “written by agents, for agents”, with the line “We are not forking TypeScript” (The New Stack). It’s two trends at once: JS tooling moving to native code, and agents doing large rewrites.
Bun 1.4.3 added bun check, a built-in TypeScript type checker, and 1.4.4 focused on getting package installs right and fast (Bun, JSDevSpace).
Node.js shipped 26.12.0 and 24.22.0 on 14 October, then security releases on 21 October for 22.x, 24.x and 26.x. Update.

Also on Hacker News

From last week’s front-page digests (1, 2, 3):

Kimi K3.1 Pro drew the most attention of any model release.
OpenShell, a runtime for autonomous agents, was discussed as a way to run them in isolation.
Astral shipped an experimental integration between uv, its Python package manager, and ty, its type checker.
A post on building a container runtime from scratch did well. Its takeaway was that containers are just processes with kernel restrictions, which we agree with, and which is where most of the interesting work is.

Most links here are secondary coverage. Where numbers matter to you, check the vendor’s own announcement.

Kiri Blog

Why is everyone suddenly putting AI agents in a box?

What is an agent sandbox?

What changed

What this series covers

Review the Dockerfile your agent wrote

The six checks

After review

Make the agent get it right

A file in your Downloads folder can hijack your coding agent

What happened

How well it works

Why there is nothing to patch

What to change today

Check whether you were hit

The longer fix

How a container gets a GPU

Two halves of a driver

The version rule

The part that runs as root

Sharing one card

And on a Mac?

Run your MCP servers in a box

What that program can reach

Boxing one server by hand

Many servers: a gateway

What the box doesn’t fix

Security roundup: 19–25 October 2026

Supply chain: the one developers should read first

LiteLLM was poisoned on PyPI and Docker Hub (21 October)

The pattern: hijacked releases, not lookalike packages

Exploited right now: patch these first

Critical bugs to patch

AI coding agents are now a target

Ransomware and breaches

This week’s checklist

What's hot: agent sandboxes, Claude Fable 5.1 and TypeScript in Rust

Agent sandboxes became infrastructure

Claude Fable 5.1 and Opus 5.5: agent loops got cheaper

JavaScript: TypeScript in Rust, and a quieter week for Node and Bun

Also on Hacker News