$ cat agent-security/month/2026-10-01.log
the month in review · October 2026
sandbox-runtime 0.0.79 fixes denies broken by glob
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Folders with brackets, stars or question marks in their names silently matched no deny rule on any platform; the fix also ships alongside a Node floor raise to 22.12.
v0.0.79 anthropics/sandbox-runtime
A path entry whose characters read as a glob pattern is now also read as the literal path it spells, where that exists. If you operate on macOS or have workspaces with bracketed directory names, your denyWrite entries were matching nothing until this release; re-run your policy tests against real paths rather than trusting a green suite.
fix(mcp-receipts): reject unsigned chains and empty signer trust microsoft/agent-governance-toolkit
The offline verifier accepted unsigned receipt chains and reported valid signatures, while the library rejected the same chain, and it treated trusted_keys=[] as unrestricted signer trust. Both are closed; if you rely on receipts as evidence for a deploy gate, treat any verification result produced before this fix as unproven.
fix: upgrade mcp to 1.30.0 for Snyk vulnerability snyk/agent-scan
agent-scan moves to mcp 1.30.0 for a Snyk-reported vulnerability. The entry gives no CVE, so plan the bump on the assumption the flagged code path is reachable from scanning untrusted MCP server config, and pin 1.30.0 as your floor.
feat(vscode): discover MCP servers registered by extensions in code snyk/agent-scan
Extensions that call vscode.lm.registerMcpServerDefinitionProvider register MCP servers with no mcp.json anywhere on disk, which left those servers invisible to the existing extension scan. agent-scan now finds them, closing a blind spot for anyone auditing what their editor can start. The follow-up gates the scan per fork so non-VS Code hosts do not produce false positives.
linux: deny every dangerous name of a subdirectory, not only those three levels down anthropics/sandbox-runtime
The mandatory write denies below the working directory on Linux missed some names one level down, because the names came from a single file listing capped at three levels by default. Every dangerous name of a subdirectory is now denied whatever else the tree holds; the practical effect is that a nested build output can no longer hide a denied write from you.
linux: one mount per destination, so bubblewrap 0.4 starts anthropics/sandbox-runtime
Duplicate masks from a trailing slash, a symlinked directory, or a denyRead entry that is also a credential mask left /dev/null at the same mount destination, and bubblewrap 0.4.0 and 0.4.1 refuse that. One mount per destination means wraps now start on those hosts instead of failing. The separately merged restart fixes, where a wrap that started over re-counted from nothing or skipped re-readi...
Raise the supported Node floor to 22.12, and move CI to Node 22 anthropics/sandbox-runtime
engines goes from Node >=20.11.0 to >=22.12.0 and CI moves to Node 22, since Node 20 is end of life and 22.12.0 is the first release where JSON modules and import attributes are no longer experimental. If you pin sandbox-runtime inside a Node 20 image, that image stops being supported.
feat: honor tool_output.parallel and tool_input.parallel for per-tool rails NVIDIA-NeMo/Guardrails
rails.tool_output.parallel and rails.tool_input.parallel were silently ignored for per-tool checks, with only a warning; IORails now honors them. Alongside: Guardrails also added CEL rules per tool, a pre-tool-call gate in NeMo Relay that blocks denied calls, streamed tool calls, and a language-detector rail, while the DockerDeployer stop honoring values that overrode governance settings.
$ ls agent-security/month/ # the briefings behind this review
Keep up with Agent Security in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.