RepoJournal
Agent Security Agent Security
39 wires and counting

$ follow Agent Security

Keep up with Agent Security in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-11-10
stories 12
RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

Sandbox Runtime 0.0.82 narrows the Windows profile read grant

By RepoJournal · Filed · About Agent Security · Composed from the cited sources · methodology

ig-ant Shivam Sharma phsommer Kasra Ghodsi
4 people shipped this
ig-ant @ig-ant 3 cited Shivam Sharma @ShivamSharma43 phsommer @phsommer Kasra Ghodsi @KasraGhodsi

A permissions regression in the Windows sandbox shipped in 0.0.81 left Documents, Desktop and most of AppData readable to sandboxed commands, and the fix plus a tightened CI trust store land in v0.0.82.

Release v0.0.82 (#816) anthropics/sandbox-runtime

by ig-ant

Anthropics shipped v0.0.82 as the vehicle for the Windows grant fix, so this is the version operators on Windows should be running rather than 0.0.81.

windows: narrow the profile read grant to a listed set anthropics/sandbox-runtime

by ig-ant

The Windows profile read grant narrows from "the whole profile minus exclusions" to a built-in list of tool directories, since 0.0.81 left Documents, Desktop and most of AppData readable to sandboxed commands. Unlisted directories now get no read access, `srt-win profile grant --include` adds paths back, and `initialize()` upgrades an older grant by itself, revoking what fell off the list: tool...

ci: extend the runners' CA root list anthropics/sandbox-runtime

by ig-ant

The CI trust store drop list grows from 5 roots to 19, each identified by the SHA-256 of its certificate and of its public key, so 38 hashes now appear across all 17 copies in `integration-tests.yml` and `release.yml`. The step logic is unchanged; only your own CA expectations if you mirror these workflows are affected.

$ ls agent-security/reviews/ # the step-back reads

the week in review Guardrails moves snapshot keys, breaking, and patches advisories the month in review sandbox-runtime 0.0.79 fixes denies broken by glob
Full archive → Weekly reviews →

Quick answers

What shipped in Agent Security on November 10, 2026?
A permissions regression in the Windows sandbox shipped in 0.0.81 left Documents, Desktop and most of AppData readable to sandboxed commands, and the fix plus a tightened CI trust store land in v0.0.82. In total, 6 commits, 5 pull requests, and 1 releases landed.
Who contributed to Agent Security on November 10, 2026?
4 developers shipped this update, including Shivam Sharma, phsommer, Kasra Ghodsi, and ig-ant.
What were the notable Agent Security updates?
Release v0.0.82 (#816), windows: narrow the profile read grant to a listed set, and ci: extend the runners' CA root list.
♥

$ log Agent Security --recent

Quiet day in agent security as guard coverage reaches four clients 2 shipped Hypervisor event queries stop returning everything on limit=0 4 shipped Injection rail now blocks when redaction is incomplete 41 shipped An opt-in OS-enforced Windows sandbox for srt 14 shipped

$ log --all # elsewhere on the wire

Alignment & Post-training Anchored math grading by default in MILES, and one launcher for every dense Qwen3 TPU recipe Interpretability TransformerLens 4.4.0 lands, and SAELens patches four ways its loaders misread checkpoints

$ ls showcases/

Safety Evals AI Red Teaming Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.