The popular Tensorlake SDK, a package with more than 12,000 weekly downloads and 1000 GitHub starts shipped a poisoned release (version 0.5.144 ) that was infected with the self-propagating Shai-Hulud ...

Endor Labs discovered a critical vulnerability in n8n (CVE-2026-25049) that allows unauthenticated users to achieve remote code execution (RCE) via sandbox escape. We discovered a critical ...

VMs, containers, V8 isolates, WASM and agent sandboxes all promise containment. Here's what each one really stops, what it costs, and where it leaks.

I found a flaw in brig where an agent inside the sandbox plants a symlink resulting in an arbitrary host directory with read-write abilities in and out of the sandbox. Tracked as GHSA-wp6x-29qx-fpr7 ...

Endor Labs and SpaceXAI are partnering to secure every stage of agentic software delivery on Grok Build, from the first tool call to merged pull requests. AI coding agents now write a large share of ...

Nine days after GPT-6 Sol, Codex with GPT-6.1 Sol scores 77.7% FuncPass and 34.1% SecPass — within one task of GPT-6 Astra on security, a third faster, and with zero confirmed cheating.

There are different definitions of Agent Sandboxes circulating, but the strictest defines it as an isolated runtime in which an agent's tool calls execute under constraints that the agent cannot ...

ipv6desthao() may call pskbexpandhead() for a cloned skb, which can move the skb head and invalidate the cached network header pointer.

A rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a ...

An invitation-only dinner for senior security and engineering leaders exploring how defenders can put frontier AI to work, securing applications from code to cloud. Hosted by Varun Badhwar, Founder & ...