$ cat agent-security/week/2026-09-28.log
the week in review · Sep 28 – Oct 4, 2026
MCP receipt verifier rejects unsigned chains
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
The offline verifier now counts each unsigned CLI receipt as a verification failure and refuses an empty trusted_keys list as blanket signer trust.
fix(mcp-receipts): reject unsigned chains and empty signer trust microsoft/agent-governance-toolkit
The offline verifier accepted unsigned receipts and reported valid signatures while the library rejected the same chain, a mismatch that let unverified receipts pass inspection. If you validate agent receipts offline, empty trusted_keys is no longer blanket signer trust: pin your trusted keys before upgrading, or verification will start failing where it used to pass.
fix: restore recursive-delete enforcement in CLI plugins microsoft/agent-governance-toolkit
The bundled Bash regex missed real rm -rf commands in Claude Code and Copilot CLI, and the parser split around substitutions, missing deletions like rm -r "$(pwd)/src" -f while falsely denying harmless text. Operators who lost or gained blocks depending on shell syntax should re-test their deny rules against the restored parser.
linux: one mount per destination, so bubblewrap 0.4 starts anthropics/sandbox-runtime
Duplicate spellings of one file (a trailing slash, a symlinked directory, a denyRead entry doubling as a credential mask) put two file masks at the same destination, which bubblewrap before 0.5.0 rejects. Hosts pinned to bubblewrap 0.4.0 or 0.4.1 can start their sandbox again.
linux: a wrap that starts over reads the disk again anthropics/sandbox-runtime
After a config replacement mid-wrap, the wrap kept the directories and finished walks it had already listed and never re-read the disk, so a file written after the deny rule landed could slip through unverified. The fix is on main and in no release; the related restart fix, 10, stops each replacement from costing a whole extra walk.
linux: deny every dangerous name of a subdirectory, not only those three levels down anthropics/sandbox-runtime
Deny rules for dangerous subdirectory names covered only entries three levels down, so names one level below the working directory, and names in trees the rg scan missed, went unblocked. Now every dangerous name of a subdirectory is denied regardless of depth.
Raise the supported Node floor to 22.12, and move CI to Node 22 anthropics/sandbox-runtime
engines moves from Node >=20.11.0 to >=22.12.0, which is the first release of the 22 line where JSON modules and import attributes are no longer experimental. If your deployment image still runs Node 20, it is past end of life and below the supported floor.
feat: honor tool_output.parallel and tool_input.parallel for per-tool rails NVIDIA-NeMo/Guardrails
The rails.tool_output.parallel and rails.tool_input.parallel flags are honored for per-tool checks instead of being ignored with a warning. Per-tool rails in Guardrails run concurrently once these are set.
feat(vscode): discover MCP servers registered by extensions in code snyk/agent-scan
An extension can register MCP servers through vscode.lm.registerMcpServerDefinitionProvider with no mcp.json on disk, leaving those servers invisible to the extension scan. They now show up in agent-scan, and 9 correctly limits that scan per VS Code fork, where the post-"the provider scan landed enabled" gate had gone family-wide.
$ ls agent-security/week/ # the briefings behind this review
Keep up with Agent Security in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.