RepoJournal
Agent Security Agent Security
16 wires and counting

$ follow Agent Security

Keep up with Agent Security in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-10-04
stories 5
RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

Sandbox-runtime fixes Linux wrap that re-read a file a deny rule had just blocked

By RepoJournal · Filed · About Agent Security · Composed from the cited sources · methodology

ronleizrowice-ant
1 person shipped this
ronleizrowice-ant @ronleizrowice-ant 3 cited

Anthropic's sandbox-runtime closed a Linux-only hole where a wrap that restarted handed out a command still able to read a file that a newly added deny rule was meant to block.

linux: a wrap that starts over reads the disk again anthropics/sandbox-runtime

by ronleizrowice-ant

A wrap that starts over kept the directory listing and each pattern's finished walk from before the restart, so a host that wrote proj/key.pem and then added a rule denying proj/**/*.pem got back a command that read the file anyway. Linux wraps now re-read the disk on restart, so rules you add mid-wrap apply to files created after the earlier scan; the fix is on main and in no release.

Merge pull request #644 from anthropics/fix/linux-wrap-restart-reads-again anthropics/sandbox-runtime

by ronleizrowice-ant

The fix landed as pull request #644 from the fix/linux-wrap-restart-reads-again branch. Nothing to adopt yet unless you build from main.

Merge the marker branch, which now holds main anthropics/sandbox-runtime

by Ron Leizrowice

Housekeeping merges of the marker, anchor, and listings branches fold that work into main; the only behavioral note is that a pattern match inside a mode 000 folder below the working directory is no longer writable, since main's scan for dangerous names denies it.

$ ls agent-security/reviews/ # the step-back reads

the week in review sandbox-runtime 0.0.79 fixes path denies that never applied
Full archive → Weekly reviews →

Quick answers

What shipped in Agent Security on October 4, 2026?
Anthropic's sandbox-runtime closed a Linux-only hole where a wrap that restarted handed out a command still able to read a file that a newly added deny rule was meant to block. In total, 4 commits and 1 pull requests landed.
Who contributed to Agent Security on October 4, 2026?
1 developer shipped this update, including ronleizrowice-ant.
What were the notable Agent Security updates?
linux: a wrap that starts over reads the disk again, Merge pull request #644 from anthropics/fix/linux-wrap-restart-reads-again, and Merge the marker branch, which now holds main.
♥

$ log Agent Security --recent

Approval digests get RFC 8785 float serialization; sandbox-runtime 0.0.80 kills a 300 ms path 13 shipped Sandbox-runtime closes silent data loss, Agent Guard gets release 0.6.9 40 shipped Guardrails adds CEL rules per tool, agent-scan stops missing Copilot CLI projects 23 shipped Guardrails streams OpenAI Chat under guard, sandbox-runtime goes namespace-strict on Linux 22 shipped

$ log --all # elsewhere on the wire

Alignment & Post-training verl rejects conflicting vLLM engine_kwargs, open-instruct adds MILES OPD behind a Megatron learner Interpretability nnsight 0.8.0 cuts import time from 7.6s to 1.6s

$ ls showcases/

Safety Evals AI Red Teaming Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.