Security
Vulnerabilities, supply-chain attacks and incidents in the wild, and what to do about them.
Why is everyone suddenly putting AI agents in a box?
AI tools used to suggest code. Now they run it. What an agent sandbox is, and why every team running agents needs one.
Review the Dockerfile your agent wrote
Agent-written Dockerfiles build, run and often ship your keys. Six things to check in review, what to change, and how to make the agent get them right first time.
A file in your Downloads folder can hijack your coding agent
A planted AGENTS.md told a coding agent to install a malicious npm package. How the attack works, why no patch fixes it, and what to change today.
Run your MCP servers in a box
An MCP server is a program that runs as you, with your keys and your network. How to put each one in a container, and what that does and doesn't protect.
Security roundup: 19–25 October 2026
LiteLLM poisoned on PyPI, exploited Arista, BeyondTrust and Ivanti bugs, Node.js and Brotli fixes, and an attack aimed at AI coding agents. What developers should patch.