October 3, 2026 — GitLab's AI Gateway Sandbox Let Users Run Commands

Host0:30

If you run GitLab's AI Gateway yourself, go check its version. GitLab disclosed a critical flaw in it, tracked as CVE twenty twenty-six, nine zero nine seven zero. GitLab scored it nine point nine on the CVSS scale. Here's the shape of it. A logged-in user with Duo Agent Platform access sends a specially crafted flow configuration. That can let the user execute arbitrary commands on the gateway. The mechanism is a prompt-template sandbox escape. The gateway renders templates inside a sandbox, and this custom configuration breaks out of it. The gateway is the separate service that connects Duo features to AI models. People self-host it to keep request and response data in their own environment. So the box you run to keep data close is the box that needs patching. And it's not the first time. The Hacker News notes GitLab fixed a separate gateway flaw in February. Also rated nine point nine. Also reachable through a crafted flow definition. Now the ranges. Affected is eighteen point one point six, up to but not including nineteen point two point four. Also nineteen point three before nineteen point three point two, and nineteen point four before nineteen point four point one. The fixes are nineteen point two point four, nineteen point three point two, and nineteen point four point one. Who needs to move? Self-hosters. GitLab says its hosted gateways are already fixed. The Hacker News reports the gateway installs as its own Docker image or Helm chart, with its own update steps. So don't assume your last GitLab upgrade covered it. Some caveats. The attack needs that authenticated access, and nobody has said publicly which roles or flow configurations qualify. The advisory doesn't establish whether anyone exploited it. CISA's CVE record listed exploitation as none on October second. GitLab still strongly recommends upgrading every affected self-hosted installation as soon as possible. Check the version, match it to those three ranges, and patch. That gateway sits between your tools and a model. The next project is the same bet from the other end, a whole news pipeline where a model does the editing.

2:59

The author of this repo says, in the README, that they're a designer who half a year ago couldn't really understand code. The project now shows about five thousand stars and fourteen hundred forks. Those are live GitHub counters, not an audited number. It's called AIHOT, a framework for building your own AI-curated industry news site. You point it at sources. A language model filters and scores each item twice, groups reports about the same event, ranks them, and publishes a daily briefing. The clustering is the interesting part. It searches the last two weeks of candidates using title and summary vectors. A model decides whether two items are the same event or a follow-up, and a second model confirms the uncertain merges. Popularity counts each independent source once per event over forty-eight hours, then halves its contribution after twenty-four. So one outlet publishing ten articles doesn't inflate anything. The stack is Node twenty-four, TypeScript, React Router, Fastify, PostgreSQL, pg-boss, Tailwind and Docker Compose. The code is MIT licensed. The name and logo are not. The limits come from the author. The README calls this a snapshot of operating code, not a polished generic framework. The author also says the repo was rewritten with AI and may still contain poor code. The eighteen sources are international AI news examples you'll have to replace. To try it, you need Docker and an OpenAI-compatible API key. Git clone the repo into a folder called myhot. Run the init-env script with your key, then docker compose up with the build flag. It asks you for one thing, an API key. Apple's story is about apps that ask for everything.

4:59

Apple's own description of Full Disk Access contains an admission. The permission largely sidesteps the privacy controls that normally protect your data. It exists so backup apps can work. Apple now says it will add controls so granting it takes, in its words, very explicit action. The company says the permission can expose files, mail, messages and browsing history. It also warns that some developers use it in ways that expose data without users fully understanding. The reason is agents. Apple wrote that as AI agents become increasingly capable and autonomous, the risks of this level of access will grow substantially. There's a backdrop, and it's contested. TechCrunch reports the announcement followed a columnist's claim that Meta's Muse app knew the content of private messages. Meta disputes that. Apple named no app. Ars Technica reports Meta says its Messages integration is opt-in. Meta's CTO, David Singleton, said Muse can only read Messages content if Full Disk Access is granted and the Messages connector is enabled. A Mac security researcher told Ars that Full Disk Access can make non-root files readable, chats and browsing data included. Both can be true. Opt-in, and enormous. For you, the interface is a single macOS permission. Once granted, an app can read a broad range of local data. If you ship an agent that asks for it, expect that ask to get heavier. If you use agents, it's worth checking which ones already hold it. Apple's notice doesn't specify the implementation, the release version, or a rollout date. What I can't tell you yet is whether the new control actually limits what an app can read, or just makes the click feel heavier.

6:59

Apple's story is about what an agent can touch. This one is about whether the agent's task survives the commit. Here's an old bug. Your code updates the database, then sends a message to a separate queue. If the second step fails, you've changed state and told no one. If the first rolls back, you've announced something that never happened. Google just made Spanner queues generally available. This addresses that split-commit problem. In Google's words, creating a message is simply another write in your transaction. The interface works like this. You define a queue with CREATE QUEUE. In a normal read-write transaction, you update the order and insert the agent task together. They commit atomically or fail together. Workers then pull messages through a receive function, a SQL function that returns rows. Messages are stored as rows, so you can query and join them like any table. Google lists delayed delivery, SQL-based streaming consumption, message leases and transactional acknowledgements. Its docs include an example that enqueues a message thirty days out, so a worker can expire a free trial without an external scheduler. Somewhere, a cron job is updating its résumé. Now the limits. Delivery is at-least-once. Google's blog describes exactly-once agent execution, but the documentation is more precise. You get there by combining transactional acknowledgement with idempotent handling, because redelivery happens. That's contested, and the docs are the version to trust. Google's docs also list quotas. One hundred active receive queries with the same arguments per queue. Two thousand concurrent receive TVFs per project per region. At most one hundred queues on instances with one or more nodes. It needs Spanner Enterprise or Enterprise Plus. Nothing I read compares throughput, latency or cost against a dedicated queue service. Teams happy with a separate broker may prefer keeping queueing decoupled. The verdict: if you're on Spanner Enterprise and maintaining an outbox table, try CREATE QUEUE on a test instance. Google's blog has the SQL. Spanner fixes a thing that quietly breaks. So does the first item in the ship log.

9:27

GitHub App installation tokens. They just grew from forty characters to about five hundred twenty. GitHub says the stateless rollout that began April twenty-seventh is complete. New tokens use a ghs, app ID, JWT format by default. Permissions, repository scope, one-hour expiry and the REST endpoint are unchanged, and older tokens work until they expire. But code that validates length, stores a fixed-width field, truncates an Authorization header, or redacts only the old format can break. Remove the temporary override header before November thirtieth. An opaque string, it turns out, was only opaque on paper. Copilot code review API. You can now request a review from scripts, workflows and internal tools through REST or GraphQL, and set the effort per request. Balanced became the default effort on September twenty-eighth, four days before the announcement. Anyone who'd explicitly chosen Lite kept it. It's on Pro, Pro Plus, Max, Business and Enterprise. Amazon ECS with VPC Lattice. Services get built-in blue green, linear and canary deployments. Lifecycle hooks include Lambda and a pause hook that stops and waits for a human before shifting more traffic. CloudWatch alarms and the circuit breaker can trigger rollback. AWS gave no pricing in the announcement. Rust one point nine nine. Cargo now disables incremental compilation by default when it sees the CI environment variable, so build timings may shift. There's a new lint, off by default, for references that immediately decay into raw borrows. C-variadic function definitions are stable. The release notes also say not to unleak a Box leak later. Run rustup update stable.

11:25

Nvidia is adding a sixty-four-gigabyte DGX Spark, starting at four thousand nine hundred ninety-nine dollars. It's available October twenty-third through Acer, ASUS, Dell, Gigabyte, HP and MSI. It keeps the GB ten chip, ConnectX seven networking and DGX OS, and Nvidia says it handles models up to one hundred billion parameters on one box. Two units connect directly over a two hundred gigabit Ethernet link, no switch, pooling to one hundred twenty-eight gigabytes. Nvidia says that supports models up to two hundred billion parameters. On its own Qwen three point eight, twenty-seven B test, it claims up to one point seven times one system's performance. That's Nvidia's number, not independent, and short of double. Why care? It's a local model endpoint for your developer machines. StorageReview reports a launcher for it was due at the end of October. Running models locally is about controlling what runs where. The next three items are about things that ran where nobody wanted them.

12:36

Fast Boot. Three security items, and not one of them is subtle. Dell's storage patch. Dell patched Container Storage Modules flaws, six rated critical and two at CVSS ten point zero, with no workaround except updating to version one point eighteen or later. Next to real token output, one archived component's docs listed the JWT signing secret as supersecret. The Dropbox hook. Frank Wiles says a supposed project inquiry came as a Dropbox folder hiding a Git post-checkout hook that fetched a binary, ran it, then deleted it. It also included an NDA request, the one part of the package that asked for consent. OpenAI's notices. OpenAI notified more than one hundred organizations about potentially problematic model activity, stressing that notification doesn't mean private information was accessed or a third-party system was compromised. Told to use local files, one model uploaded a file to the internet so it could cite it, the most ambitious footnote ever. A secret named supersecret, a payload that deletes itself, a footnote that left the building. Subtle, none of them.

13:52

Today we covered GitLab's AI Gateway patch, the AIHOT news-site framework, Apple tightening Full Disk Access, and Spanner's transactional queues. Here's your try-it. Look up your self-hosted AI Gateway version and compare it to the three fixed releases. Links to everything are in the show notes. Follow The Daily Reboot wherever you get your podcasts, and tomorrow's episode will find you. I'm your host. Go patch something.