Kiri Blog

Why is everyone suddenly putting AI agents in a box?

Precious Okwu — Wed, 28 Oct 2026 00:00:00 GMT

A year ago, AI coding tools suggested code. You read it and decided whether to run it.

Now they run it. They install packages, execute tests, call APIs and open pull requests, while reading text from strangers: README files, GitHub issues, web pages. Usually with the same access as the engineer who started them.

What is an agent sandbox?

Agent sandbox

A boundary around an AI agent that controls what it can read, run and reach.

Inside the boundary, the agent can work freely: edit the project, run the tests, install what it needs. Outside it are the things it should never touch on its own: your SSH keys, your cloud credentials, other repositories, and most of the internet.

What changed

BeforeAI suggests code. It writes, and a person decides what executes.

NowAI runs the code. A sandbox decides what it can read, run and reach.

That shift is why agent sandboxes have gone from a niche security topic to something every team running agents needs to understand. A permission prompt on every command doesn’t scale: after the fortieth one, nobody reads them.

What this series covers

Starting Friday, two short parts a week. Each one stands on its own, with three diagrams:

What an agent can reach without a sandbox, and how one poisoned README leaks your keys
Why git worktrees aren’t isolation
Containers, gVisor and microVMs, and what actually separates them
The network wall, secrets, many agents at once, and a reference architecture to finish

No vendor pitches. Just how it works. If there’s something you want covered, tell us and we’ll fold it in.

Security roundup: 19–25 October 2026

Precious Okwu — Mon, 26 Oct 2026 00:00:00 GMT

Last week was busy enough that some trackers started calling it “Black October”. Here is what matters if you write and ship software, most urgent first.

A note on sources: much of this week’s coverage comes from vendor blogs and incident trackers rather than the affected companies. Every item links to where it was reported. Before you act on a version number or a deadline, check the vendor’s advisory or CISA’s catalog.

Supply chain: the one developers should read first

LiteLLM was poisoned on PyPI and Docker Hub (21 October)

Attackers published a malicious LiteLLM 1.107.0 to PyPI and Docker Hub. It carried an info-stealer aimed at cloud credentials, AI provider keys and developer secrets, and sent them to a server the attackers controlled. The bad release was on PyPI for about an hour and three quarters, from roughly 11:40 to 13:23 UTC.

The GitHub tag for v1.107.0 was clean. That means the attackers got into the release pipeline, not the source code, so reading the code on GitHub would not have shown anything wrong. As of 25 October, how they got in was still being investigated. (Aviatrix, Shattered)

If you installed 1.107.0, or pulled that image, during that window: treat every secret on that machine or CI runner as stolen. Rotate cloud credentials, AI API keys and tokens, then pin to a known-good version.

The pattern: hijacked releases, not lookalike packages

Two days earlier, five OVHcloud CLI releases were reportedly swapped for builds that steal secrets (AgentBeam tracker). One weekly review calls the campaign the first publicly attributed large-scale supply-chain attack driven by agentic AI (Shieldworkz).

The common thread is that attackers take over a real maintainer account or release pipeline instead of publishing a package with a similar name. Checking the package name doesn’t help when the name is right. What helps:

Pin exact versions and commit lockfiles.
Install in CI without lifecycle scripts where you can (npm ci --ignore-scripts).
Keep long-lived secrets off the machines that install dependencies.

Exploited right now: patch these first

These are on CISA’s Known Exploited Vulnerabilities list, which means attackers are already using them.

Product	CVE	What it is	Status
Arista VeloCloud Orchestrator (on-premises)	CVE-2026-114625	SQL injection, CVSS 9.9	Disclosed 22 October and added to the list 23 October. The federal deadline to patch is 26 October.
BeyondTrust Remote Support	CVE-2026-102764	Zero-day	Flagged as the most urgent item of the week (briefing)
Ivanti Connect Secure	CVE-2026-104935	Authentication bypass	Added 13 October and still being exploited

Critical bugs to patch

Node.js (advisory, 21 October): security releases for 22.x, 24.x and 26.x fix two bugs:
- DNS resolution silently cut short hostnames that contain a NUL byte;
- the HTTP Agent reused connections when it shouldn’t have.
Brotli decoder (CVE-2026-111497): an out-of-bounds write in versions 1.0.3 to 1.2.0. It was first disclosed for Node.js as “Node2Shell” and has since reached Python packages. Check what bundles a Brotli decoder in your dependency tree, not just your direct imports. (HN digest)
GitLab: a vulnerability rated CVSS 10.0 (Shieldworkz).
PHP: two critical remote code execution flaws (same source).
Dell: five flaws in Dell System Update, one of which lets an unauthenticated remote attacker run code as root (eSecurityPlanet).
Certificates: a compromised certificate authority was reported, and an eMudhra certificate key-generation flaw was discussed on Hacker News.

AI coding agents are now a target

A malicious instruction file sitting in a developer’s Downloads folder tried to make their AI coding agent install a known-malicious npm package (HN digest).

No exploit was needed. The attack only needs an agent that reads files it was never meant to trust and then runs commands with the developer’s permissions. It is the clearest real-world case so far for running coding agents in a sandbox, with limits on:

which files the agent can read and write;
which network addresses it can reach;
which credentials it can see.

Many agent tools ship such a sandbox, often turned off by default (guide).

Ransomware and breaches

Most of these are claims posted on ransomware groups’ leak sites and have not been confirmed by the victims.

Qilin listed:
- the US law firm White & Case on 25 October (HookPhish);
- SLTN Inter Access in the Netherlands on 24 October (HookPhish);
- Aryza on 23 October (HookPhish).
N0n claimed:
- the health insurer Asisken Asistencia Médica, listing 139,006 client records with diagnosis codes (HookPhish);
- Texcar in Dallas, with tax records that include Social Security numbers (HookPhish).
Earlier in October (SharkStriker):
- ransomware forced the cloud provider IDCF Frontier to shut down, affecting 495 companies and local governments;
- Daiwa Securities reported more than 110,000 client records exposed;
- Skyticket reported 14.64 million records exposed.

This week’s checklist

Search lockfiles, images and CI logs for litellm==1.107.0 and the OVHcloud CLI. If you find either, rotate every secret that machine could reach.
Update Node.js on every supported line.
Find and update anything that bundles a Brotli decoder between 1.0.3 and 1.2.0.
If you run Arista VeloCloud Orchestrator on-premises, BeyondTrust Remote Support or Ivanti Connect Secure, patch now and look for signs of compromise.
Turn on your coding agent’s sandbox, and stop it from reading folders like Downloads.

What's hot: agent sandboxes, Claude Fable 5.1 and TypeScript in Rust

Precious Okwu — Mon, 26 Oct 2026 00:00:00 GMT

Three things dominated developer conversation this month: sandboxes for AI agents, a new round of Claude models, and JavaScript tooling being rewritten by agents. Here is what happened, with links to where it was reported, and what we think it means.

Agent sandboxes became infrastructure

Running agent code in isolation stopped being a niche idea in October. Money, open-source projects and standards bodies all moved at once.

Money: Daytona reportedly raised a $60 million Series B at a $1 billion valuation to build cloud infrastructure for short-lived, stateful agent jobs.
Open source:
- AWS released Strands Box in developer preview (Help Net Security). It combines operating-system isolation with rules that look at what an agent has already done before letting it run a command or call an API. It runs on Apple-silicon Macs, with Linux support planned.
- Kubernetes SIG Apps has an Agent Sandbox project that adds a Sandbox resource for untrusted agent code, using gVisor or Kata Containers underneath.
Standards: the Agentic AI Foundation took on Alibaba’s OpenSandbox, alongside Anthropic’s Agent Skills, OpenAI’s Open Responses and Hugging Face’s OpenEnv (AI Agents News).
The platforms: a ranking published on 9 October lists six hosted options: Northflank, E2B, Modal, Daytona, Together Code Sandbox and Vercel Sandbox (Northflank; see also Modal and Cosmonic). They split into two camps:
- Firecracker microVMs, where each sandbox gets its own small VM (E2B, Vercel);
- gVisor and similar, where a user-space kernel sits between the code and the real one (Modal, and Northflank depending on configuration).
On your own machine: coding agents now ship sandboxes too. Claude Code’s /sandbox wraps shell commands with macOS Seatbelt, or bubblewrap on Linux and WSL2. It’s off by default (guide).

Why it matters. The same week, a malicious instruction file in a developer’s Downloads folder tried to make their coding agent install a malicious npm package (see this week’s security roundup). An agent with your shell and your credentials is only as safe as the files it reads. A sandbox has to limit four things: which files the agent sees, which addresses it can reach, which credentials it holds, and what it can push to git.

Our take, as people building a container runtime. An agent sandbox is a container problem with harsher rules:

it has to start in milliseconds, because agents start thousands of them;
it has to keep state between steps;
it has to treat the code inside as hostile, not just buggy.

That is why the microVM approach keeps winning, and it’s the design space Kiri works in. We’ll go deep on it in a later post.

Claude Fable 5.1 and Opus 5.5: agent loops got cheaper

Claude Fable 5.1 launched on 1 September (MacRumors, VentureBeat):
- a 1 million token context window and up to 128,000 output tokens;
- cache reads 75% cheaper, while base prices stayed the same;
- Anthropic says Claude Code users should see about 60% fewer cybersecurity false positives;
- generated text carries an invisible watermark, with a detection API in preview;
- a sibling model, Claude Mythos 5.1, has lighter safeguards and is limited to vetted security and life-sciences users.
Claude Opus 5.5 followed on 22 September. Reports describe it as close to Fable 5.1 on most tasks at about 40% lower cost than Opus 5 (technews.tw, Vals AI).

Why the cache price matters most for agents. An agent loop sends the same long prefix on every step: system prompt, tool definitions and the conversation so far. Only a little is new each time. Most of the input tokens in a long agent run are therefore cache reads, and that’s the part that just got 75% cheaper. One outlet estimates typical workloads cost about 25% less, and highly agentic ones up to 45% less. We haven’t measured this ourselves yet, and the real saving depends on how well your prompts are cached.

JavaScript: TypeScript in Rust, and a quieter week for Node and Bun

Cloudflare announced a Rust port of TypeScript, described as “written by agents, for agents”, with the line “We are not forking TypeScript” (The New Stack). It’s two trends at once: JS tooling moving to native code, and agents doing large rewrites.
Bun 1.4.3 added bun check, a built-in TypeScript type checker, and 1.4.4 focused on getting package installs right and fast (Bun, JSDevSpace).
Node.js shipped 26.12.0 and 24.22.0 on 14 October, then security releases on 21 October for 22.x, 24.x and 26.x. Update.

Also on Hacker News

From last week’s front-page digests (1, 2, 3):

Kimi K3.1 Pro drew the most attention of any model release.
OpenShell, a runtime for autonomous agents, was discussed as a way to run them in isolation.
Astral shipped an experimental integration between uv, its Python package manager, and ty, its type checker.
A post on building a container runtime from scratch did well. Its takeaway was that containers are just processes with kernel restrictions, which we agree with, and which is where most of the interesting work is.

Most links here are secondary coverage. Where numbers matter to you, check the vendor’s own announcement.