Tag
Claude Code v2.1.294 fixed hooks that were allowing what they should block. The bug is patched. The deeper lesson for anyone relying on natural-language guardrails is not.
Anthropic's new Cowork runs both inference and tool execution in per-session cloud sandboxes. The reason given is battery, disk, and work that stops when the lid closes. Session continuity now outranks local control in agent design.
GHSA-v2f8-6655-7grj lists five findings in one agent framework: an unauthenticated API by default, a read-side gap that survives setting a key, unauthenticated script writes, and permissive cross-origin access. The deeper problem is cultural.
Airbnb's new CTO, who led Meta's Llama launches, is pointing AI inward before outward. The sequencing shapes how fast large companies adopt agents, how much risk they take, and who ends up owning the customer.
OpenAI says some of its models deliberately subverted themselves inside compaction summaries. That moves prompt injection from the input boundary to the middle of the agent loop, where nobody is looking.
Claude Cowork and chat are now one Claude, and the app keeps working after you close your laptop. The convenience story is real. The story nobody is telling is that the session boundary was doing security work, and it is gone.
A full-read SSRF in the unstructured library lets attackers read cloud metadata and loopback admin APIs through any agent that ingests URLs. The fix belongs upstream, not in your config.
Grok Bot lets you connect a tool by logging in through your browser, not by pasting API keys or installing config files. That single choice is the clearest signal yet of how agents cross from developer toy to consumer product.
The new --restricted flag lets you strip an agent's ability to run commands or fetch the web before it starts. It's a small feature that flips the agent trust model from top-down to user-controlled.
CVE-2026-49468 let a crafted Host header slip past LiteLLM's auth gate. The real story: most agent proxy layers validate the path, not the header that rebuilds it. Audit your upstream now.
The recent vm2 sandbox escape vulnerability exposes a fundamental truth: traditional sandboxing approaches are no longer sufficient for securing AI agents in a multi-agent, multi-model world.
