$ cat agent-security/week/2026-10-05.log
the week in review · Oct 5 – Oct 11, 2026
sandbox-runtime 0.0.79 fixes path denies that never applied
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Any folder whose name contains glob characters silently escaped read and write denies, and a proxy crash on malformed upstream status codes took down the process.
v0.0.79 anthropics/sandbox-runtime
The fix closes the case where a folder like [wip] app or br[1] made a deny match nothing, on all platforms, so files under a denied path stayed reachable. 0.0.79 also carries a proxy fix that answers 502 instead of dying when an upstream sends a status code Node refuses to write. If your policy targets paths under directories with brackets, asterisks or question marks, your denies were not bein...
Let a caller mark a path entry literal: `{ path, literal: true }` anthropics/sandbox-runtime
denyRead, allowRead, allowWrite and denyWrite now take { "path": "...", "literal": true } next to the plain string form, so you can state that a path entry is a name and not a glob. It is the middle of three stacked changes: the anchor option came first, and expressing discovered paths as marked entries follows.
fix(agent-mesh): don't count unassessed compliance controls as met microsoft/agent-governance-toolkit
ComplianceEngine.generate_report() computed controls_met as total_controls minus violated, and because only violations were stored, a control that check_compliance() never looked at read as passing. Reports now stop counting unassessed controls as met, which changes the numbers your compliance output shows.
fix: upgrade mcp to 1.30.0 for Snyk vulnerability snyk/agent-scan
The bundled mcp dependency moves to 1.30.0 to clear a Snyk-reported vulnerability, and a separate fix lifts the transitive multidict to >=6.9.1 (resolved 7.0.0) for SNYK-PYTHON-MULTIDICT-20510280, rated medium. Operators running agent-scan against untrusted MCP servers should take both.
feat: discover MCP servers in VS code extensions snyk/agent-scan
agent-scan now walks VS Code extension bundles and parses their JavaScript to find MCP servers declared inside them, which is where they were previously invisible to a scan. The expansion applies under --scan-all-users and is gated to avoid false positives on hosts that are not VS Code.
feat(checks): Report /v1/checks block reason on HTTP response (IORails only) NVIDIA-NeMo/Guardrails
The /v1/checks endpoint now reports the block reason on the HTTP response for IORails, the second of three changes adding tool-call and tool-result rails. Your callers can act on the reason in the response instead of inferring it from around the check.
fix(iorails): Accept tool results without name if call_id matches NVIDIA-NeMo/Guardrails
Tool results are accepted without a name field when the call_id matches, dropping a check the OpenAI spec does not guarantee. It is the first of the three stacked /v1/checks changes, so the tool-result rail stops rejecting valid payloads.
linux: a command starts once both relays listen anthropics/sandbox-runtime
Under a network restriction the sandbox's start-up script launched two socat relays on ports 3128 and 1080 in the background and ran the command immediately, so a command that connected at once could have its first connection refused. The command now waits until both relays are listening.
$ ls agent-security/week/ # the briefings behind this review
Keep up with Agent Security in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.