$ cat agent-security/week/2026-11-02.log
the week in review · Nov 2 – Nov 8, 2026
Guardrails moves snapshot keys, breaking, and patches advisories
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Operators on both toolchains get upgrade work this week, with a wire-schema change in the AGT SDKs and three dependency bumps in Guardrails.
fix!: send the snapshot contract's keys from HostSession and the AGT adapter runtime microsoft/agent-governance-toolkit
The snapshot contract, wire schema and framework adapters in the Rust, Node, .NET and Python SDKs already agreed on model_request, model_response and output; the AGT-side seams that differed now send those keys. If your tooling parses snapshot payloads off HostSession, verify your field reads before moving to this build.
fix(library): block output when omission is incomplete in injection detection rail (#2558) NVIDIA-NeMo/Guardrails
Omission that cannot be completed now blocks the output rather than passing through, so injection detection fails closed. Related rule work closes occurrence-order bypasses in the Python, Jinja and XSS rules while keeping legacy detections and avoiding new Python prose false positives; malformed or ambiguous input in a scanning rule now blocks instead of passing.
fix(deps): upgrade Pillow to 13.0.0 for security advisories (#2581) NVIDIA-NeMo/Guardrails
Pillow moves to 13.0.0 for security advisories, and urllib3 and setuptools get the same treatment in a separate bump. If you pin these transitively, expect resolution changes on upgrade.
fix(hooks): keep judged tool arguments out of hooks-server logs NVIDIA-NeMo/Guardrails
At the hooks-server default log level, the root logger was set to INFO so the per-check line would show, and the judge prompt went with it, raw tool arguments included. That logger is now set to WARNING, so the per-check line no longer appears in logs by default; check any log-based monitoring you built around it.
fix(relay): prevent duplicate checks by requiring Relay 0.11 NVIDIA-NeMo/Guardrails
The nvidia.nemo_guardrails plugin is built against the Relay 0.11 SDK and requires 0.11.0 or later (a 0.11.0 release candidate also satisfies it). Install Relay 0.11 first: older versions keep producing duplicate checks.
windows: opt-in MXC BaseContainer backend anthropics/sandbox-runtime
Set windows.backend: 'mxc' to run srt commands under Microsoft's MXC BaseContainer, where the OS enforces filesystem and network policy with no install step. Unset means srt-win, so existing callers see no change until they opt in.
fix(agent-sre): make the AgentRollout status match its CRD schema (#4483) microsoft/agent-governance-toolkit
ResourceStatus.to_dict() wrote lastTransitionTime as a Unix timestamp float against a CRD schema that declares a string, so status updates were rejected. If a controller or dashboard of yours reads AgentRollout status, it now sees string timestamps.
fix(agent-sre): report a failed runbook rollback instead of rolled_back (#4478) microsoft/agent-governance-toolkit
Runs whose rollback action raised were still reported as ROLLED_BACK; they are now reported as a failed rollback. Alerting on a clean rollback status will start firing on runs it previously missed. Alongside: Agent Scan 0.6.11 shipped with discovery of Antigravity 2.0 global, bundled and CLI-only skill paths, and Guardrails now accepts max_completion_tokens and image metadata in server responses.
$ ls agent-security/week/ # the briefings behind this review
Keep up with Agent Security in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.