$ cat agent-security/week/2026-10-12.log
the week in review · Oct 12 – Oct 18, 2026
sandbox-runtime hardens Linux namespaces and path handling
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
A command under the seccomp helper can no longer make its own namespaces, and backwards bracket ranges no longer stop sandboxes from starting.
Read brackets that spell no set of characters as text, so no path entry keeps a sandbox from starting anthropics/sandbox-runtime
Path entries like [user-id] or backup[2024-01-15], and ordinary relative patterns such as **/.env resolved inside them, now read as text instead of compiling to no expression, so those entries no longer keep the sandbox from starting.
windows: deny entries rank as on the other platforms anthropics/sandbox-runtime
File allow and deny lists plus credentials.files become ACEs for the sandbox account, ranked against each other before srt-win runs; a denyWrite now wins over an allowWrite at or beneath it, matching the other platforms.
linux: bind a write deny that holds an allowed write path anthropics/sandbox-runtime
On Linux every deny is emitted as a read-only bind after the allow binds, so a denyWrite inside, equal to, or holding an allowed write path still takes precedence. A deny that meets no write path mounts nothing.
linux: a sandboxed command stays in the namespaces made for it anthropics/sandbox-runtime
Under seccomp, a sandboxed command can no longer create a user or mount namespace, join another, or change a mount tree, which closes the route around mounts that only hold in the namespace they were made in.
Response header bytes past ASCII reach the client unchanged under Bun anthropics/sandbox-runtime
Under Bun the proxy now hands header bytes from 0x80 up to the client unchanged instead of passing them through as UTF-8, so upstream headers read as latin1 survive the hop intact.
feat(opencode): make secret patterns configurable and add common token formats (#4280) microsoft/agent-governance-toolkit
A validated secretPatterns policy key lets operators add organization-specific credential formats to the tool output scanner without forking lib/policy.mjs, alongside new common token formats.
feat(server): integrate OpenAI Chat streaming NVIDIA-NeMo/Guardrails
Buffered and streaming OpenAI Chat requests now share one input projection and check on the guarded endpoint, so streaming responses pass the same input guardrail as buffered ones.
feat: add per-tool CEL expression rail NVIDIA-NeMo/Guardrails
A deterministic cel rail blocks a tool call or tool result when any CEL expression evaluates true, which gives you conditions over structured values rather than regex matching against text.
$ ls agent-security/week/ # the briefings behind this review
Keep up with Agent Security in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.