$ cat agent-security/week/2026-10-19.log
the week in review · Oct 19 – Oct 25, 2026
Agent hypervisor now checks commands behind sudo, doas, xargs
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
The same week brought a Windows AppContainer network fence fix and a Guardrails hooks server, with a certifi floor forcing an agent-scan bump.
fix(agent-hypervisor): check the command behind sudo, doas and xargs microsoft/agent-governance-toolkit
The agent-governance-toolkit follow-up to the earlier unwrapping of env, nohup and timeout extends command inspection to sudo, doas and xargs, which the previous change had explicitly left out of scope. If your policy rules assume wrapped commands get inspected, the hypervisor's blind spots are narrower now than the version you are running.
windows: network fence fix, a fuller fence check, and a loopback switch anthropics/sandbox-runtime
The Windows network fence now matches AppContainer tokens as well, which closes the case where a sandboxed process could reach the network despite the block, and a loopback switch ships alongside. Operators running the Windows sandbox should take the upgrade; the escape route it removes is one a workload could take without trying.
feat(hooks): Add Hooks Server NVIDIA-NeMo/Guardrails
Guardrails now ships a FastAPI server that lets agentic harnesses call PreToolUse hooks over HTTP, beginning with a /v1/hooks/claude-code endpoint. That turns policy checks into a service your harness can call rather than something embedded in the agent process, so hook enforcement survives harness restarts and applies across harnesses.
fix: bump aiohttp to resolve Snyk security vulnerabilities snyk/agent-scan
agent-scan moves aiohttp from 3.14.3 to 3.14.5, with the requirement stated as >=3.14.4, clearing four Snyk advisories: two medium, a high covering excessive allocation, and one further finding. The same release raises certifi to >=2026.10.19, which the project marks breaking, so check pinned certifi before rolling it out.
Node's built-in HTTP clients use the sandbox's proxy anthropics/sandbox-runtime
Node's built-in fetch and http/https clients ignore HTTP_PROXY and HTTPS_PROXY unless NODE_USE_ENV_PROXY=1, so sandboxed Node programs tried direct connections the sandbox then blocked, including for hosts your policy allows. The library sets the variable whenever it sets the proxy, so allowlisted hosts work again without a per-program env override.
fix(agent-os): prevent invisible-character evasion in conversation guardian microsoft/agent-governance-toolkit
Conversation Guardian now normalizes invisible Unicode before matching, and the same strategy applies to the escalation, offensive-intent and retry-loop checks, adding 447 cases. A keyword-based policy that could be defeated by pasting zero-width characters into a prompt is no longer defeated that way, with existing matches, audit content and scoring thresholds preserved.
fix(guard): carry tenant id in PowerShell hook command so uninstall revokes push key (#522) snyk/agent-scan
guard uninstall recovers the tenant id from the installed hook command before revoking the push key, but the PowerShell form never emitted TENANT_ID=, so on Windows uninstall the revoke failed and the key survived. Windows operators who have uninstalled should confirm the key is gone rather than assume it was revoked.
feat: [ADS-1434] Optionally skips non-installed agents on hooks installation in managed mode snyk/agent-scan
guard install --check-installed is a new opt-in flag letting --managed MDM installs skip agents that are not present, and it fails fast when no homes can be enumerated. Default managed behavior is unchanged, so it is only worth adopting if absent agents in your fleet are currently causing install noise. Alongside: the Windows install error message now spells out the full @anthropic-ai scope.
$ ls agent-security/week/ # the briefings behind this review
Keep up with Agent Security in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.