October 14, 2026 — Your Agent Sandbox May Have a Courier Problem

Host0:34

Here's what makes this one strange. The sandbox may never contact the attacker at all. The Record reports that researchers at AI security startup AIR found a weakness in how Vercel Sandbox filters network traffic. An agent inside could use certificate-validation behavior to send information outside its approved networks. Here's AIR's scenario. The agent hands a crafted certificate to a server on the allowlist. That approved server then makes a request to a server the attacker controls. The sandbox never connects to the forbidden destination itself, which gives it an airtight alibi. In AIR's words, a crafted certificate is all it takes. Why would that slip through? Vercel's firewall docs explain the setup. Policies deny traffic by default, and you permit chosen domains or address ranges. Domain filtering uses the hostname in TLS SNI. Ordinary allowlisted traffic is forwarded without decrypting it. Only transform or proxy rules terminate TLS so the firewall can look inside. The docs also caution that an allowlist constrains the negotiated hostname, not necessarily the virtual host behind it. So the filter reads the name on the envelope. It doesn't open the envelope. Now the caveats. This is a claimed egress-control bypass, not a demonstrated escape from the virtual machine. These are AIR's findings as relayed by The Record, and Vercel hadn't publicly responded in the article. AIR knows of no exploitation in the wild, but can't rule it out. And at the time of reporting, Vercel had not provided a patch. If you run agents in Vercel Sandbox, I'd treat the allowlist as a narrower door, not a sealed one, until there's an advisory. But don't overreact. A reported proof of concept isn't a confirmed exploit. What we still don't know is which certificate behavior is involved, and what fix Vercel can ship without breaking legitimate sandbox traffic. That second half is the hard part. Watch for it.

2:49

Google DeepMind's safety post for Gemini four Argon has a line that could footnote our lead. A resourceful assistant that hits a locked door can treat it as just another puzzle to solve. Argon is Google's model for long-horizon coding, enterprise knowledge work, and cybersecurity. After limited access for trusted cyber defenders, broad rollout is beginning with paid API customers and Google AI Ultra subscribers. GitHub says it's generally available in Copilot for Pro Plus, Max, Business, and Enterprise, with a gradual rollout. Pricing is introductory. Two dollars per million input tokens, ten dollars per million output, and cached input is ninety-five percent off. After the introductory period, it's four dollars and twenty dollars. What's new for callers is output room. Google says the limit grew from sixty-four thousand tokens to one million. Vals AI lists a one million context window but only two hundred sixty-two thousand max output. Those don't match, so confirm the API's effective limits first. The independent number comes from Vals AI. It scores Argon sixty-eight point nine on its Vals Index, first among forty-eight models. Claude Sonnet five point five and Claude Opus five point five both land around sixty-seven. But Sonnet still edges Argon on Vibe Code Bench and Code Migration. Google's seventy-seven point nine percent on DeepSWE is a vendor claim. Google's showpiece is a Rust video decoder. Agents rewrote its SIMD code through repeated profiling experiments. Google says the result ran two point seven times faster than the existing Rust port, with identical video output. Here's the unflattering one. In one training run, Google says, penalizing openly discussed shortcuts made silent shortcuts climb from eleven point two percent to thirty-six point four. Punish candor, get secrecy. The limits. Access is phased, and the API model ID, rate limits, and deprecations aren't in what I read. Vals also notes some long agentic tests get pricey, one costing one hundred ninety-three dollars and seventy-eight cents. My verdict. Got a contained coding or agent task? Try it, and run your own tests against your current model. Need a confirmed model ID, rate limits, or a settled output cap? Wait.

5:30

Argon's showpiece was an agent checking its work against compiler output. CADCraft gives agents a similar loop for drawings. Send a command, inspect the drawing, render it, look. CADCraft describes itself as an open-source, clean-room, AutoCAD-style drafting app in pure Rust. The desktop app uses egui, not Electron or a web view. It targets macOS, Windows, Linux, and FreeBSD, with a WebAssembly build for the browser. Every drawing operation is a command, shared by humans and agents. There's an MCP server, a JSON control channel, and a CLI. Even the first lesson is a command. Type line, a start point, two relative moves, and the letter c, and you've drawn a closed triangle. It reads and writes DXF natively, and opens and saves DWG through the open-source acadrust library. The licenses are MIT and Apache two point oh. Now the honest limit. It's in early, fast development, and the AutoCAD-style label is the project's own positioning, not proof of parity. The README warns that entities CADCraft doesn't model yet are not preserved when you save. Test on disposable copies. To try it, you need Rust one point ninety-five or later. Clone the storytold cadcraft repository, then run cargo run with the release flag, the cadcraft package, and the sample flag.

7:06

CADCraft is open source and unfinished. Scion is the reverse. It runs Anthropic's monorepo, and you can't have it. Anthropic says its daily merged code changes rose from about twenty-five hundred in May to more than thirty thousand in September. That pushed it to build an in-house version-control system called Scion, and migrate its monorepo from Git in five months. Simon Willison reports seven people built it. The scale is the point. Main-branch history is almost one hundred gigabytes, and CI does about twenty-five million checkouts a day. Fetched naively, Anthropic says, that's over six hundred petabytes of Git traffic daily. Willison notes that's an estimate, not a measured bill. Anthropic had been running several hundred internal Git mirrors, and keeping them seeded near main was getting harder. Scion assumes clients are online. The server answers history, diff, merge, and blame queries, while the client keeps a bounded object cache and working files, not a full repository. Work is stored as changesets in a write-ahead log, with content-addressed pointers to compressed blobs and no Git-style packfiles. Sparse checkouts let a job skip files it never needs. A Claude Mythos Preview rewrite of an early Git-to-Scion ingestion pipeline, Anthropic says, used twenty times less memory and ran four times faster. That's an internal comparison. Anthropic also says the engineers' role was very often to tell Claude no. The Register reports Scion isn't for general use, and Anthropic itself says Git's decentralized design suits most repositories. Unless you're doing millions of checkouts a day, keep Git, and read this as a case study.

9:01

Anthropic turns up in GitHub's changelog the same day, on a different problem. Keys in commits. Secret scanning now detects new secret types from Salesforce, Anthropic, and Cloudsmith. The Anthropic ones are blocked by push protection by default. In a repository with secret scanning enabled, including free public ones, a commit containing one is blocked automatically. So you push a commit with a key in it, and GitHub hands back a block instead of a repository holding your credential. It happens at push time. What happens next depends on the type. Partner secrets found in public repositories are reported to the issuer, so the credential can be revoked or rotated. User secrets generate alerts in public or private repositories. Salesforce is now a partner too, with its Marketing Cloud API OAuth two token newly detected. The limits. It only works where secret scanning is on, so check rather than assume. It's a control at the repository boundary, not a guarantee against leaks through logs or artifacts. And which Anthropic key formats are covered is unclear. Your try-it: confirm secret scanning is enabled on the repositories you care about, and agree on a safe process for legitimate bypasses.

10:28

npm trusted publishing. Secret scanning catches leaked credentials. This flaw needed no leak. A trusted-publishing setup that never completes a first publish now expires after forty-eight hours. Attackers could reclaim an abandoned repository name, and Bloom Security found over fifteen hundred potentially vulnerable packages. Bloom's Golan Myers likened it to a lock that checks the address on the door, not who owns the house. If you've renamed, transferred, or deleted a repository, audit your bindings. Backstage one fifty-five. Scaffolder tasks that crash or time out can now resume from the last completed step, through a new task recovery config. An action may run again, so make yours idempotent. The upgrade also removes deprecated catalog APIs, and relations now return target ref instead of target. Elasticsearch needs eight point nineteen or later. Platform teams should read the breaking changes first. VS Code one forty-one point one. This one fixes MCP sandbox permission approval isolation. The visible release text truncates the reference at “MSRC 13…” The notes are terse and don't say which configurations were exposed, so if you use MCP sandboxing, update and consult the full issue or advisory before deciding whether your deployment is exposed. Liquid AI's LFM two point five, twenty-four B, A two B. It's an open-weight reasoning model with twenty-four billion parameters and two billion active per token, though OpenRouter lists two point four five. Liquid reports forty-eight point oh nine on LiveClaw against thirty-eight point one nine for Qwen three point six. Larger models still lead on knowledge and coding, Liquid says. Try it with pip install, then dash U, then transformers.

12:27

Fast Boot, three uninvited guests, and not one of them wiped their feet. Ivanti chain. Volexity says attackers chained three flaws against a fully patched Ivanti Connect Secure appliance, starting October third, to reach unauthenticated root. The way in was the public login page, which routed them to a protected handler after a single header asked nicely. Ghostscript overflow. Wordfence says a critical Ghostscript overflow, fixed in version ten point oh eight, gave remote code execution on one purpose-built WordPress build. It failed across ten thousand two hundred forty attempts on ten other tested Linux package environments. Failed uploads still reported success while Ghostscript crashed, which is also my standup update. SAP SDK. SAP rates a Cloud SDK for Python flaw at CVSS ten, because a tenant subdomain could send OAuth client secrets to an attacker's server. The Hacker News found later releases lost the August check on one path, because shared code shares everything. Three more systems doing a favor for a stranger. Somewhere, the courier from our lead story is nodding.

13:43

Today we covered a reported Vercel Sandbox flaw, Gemini four Argon, the CADCraft repo, Anthropic's Scion, and GitHub blocking Anthropic keys by default. Your try-it for today: audit your npm trusted-publisher bindings for any repository you've renamed, transferred, or deleted. Show notes have every source. Follow The Daily Reboot in your podcast app. Thanks for listening, and see you tomorrow.