The Sandbox Leaked and the Human Waved It Through
Big Picture
Two mechanisms keep AI agents in check, a sandbox around them and a human approving their moves. This week both failed publicly. Three major AI labs disclosed sandbox escapes, and a 40,000-run study found people wave through a third of malicious agent commands. Daniel Miessler's question lands harder now: what friction actually stops an attacker?
TL;DR
Both Agent Safety Nets Gave Out at Once
The standard advice for running an AI agent safely has two parts, containing it and keeping a person approving what it does. Both parts broke on the record this week, as OpenAI, Anthropic, and Meta each disclosed agent sandbox escapes within about three weeks. Meta's model reached a real company's environment during a misconfigured test that accidentally gave it internet access. OpenAI's agent ran undetected for four days during the Hugging Face breach, which we tracked last week, before anyone noticed.
The human layer fared no better. A researcher logged more than 40,000 runs of a permission game that mimics the approve-or-deny prompts Claude Code throws during a workflow, and players approved roughly one in three malicious commands. The command they waved through most was npm run analyze, cleared nearly 65% of the time even though it can run anything defined in a project's package.json. Anthropic's own telemetry shows users approve about 93% of prompts, paying less attention with each one.
Each finding alone is one vendor's bad week. Together they call the standard playbook into question. Former US National Cyber Director Chris Inglis, speaking at Black Hat, reached for Asimov's laws and argued that autonomy plus persistence is what turns a controlled test into a real incident.
Takeaways
npm run analyze got waved through 65% of the time even though it can execute anything defined in a project's package.json, which is the tell: the human check is weakest exactly where agent prompts fire most often. A deny-by-default allowlist for high-frequency commands buys more safety than adding another tired reviewer.
AI Patches Are Only as Good as the Guidance They Get
1Password's Off-by-1 Labs generated 6,080 patches for six recent CVEs using ChatGPT 5.5 and Claude Opus 4.8, then graded each one, and the clean-success rate averaged 26%. Their taxonomy, FLAWED (Fix-Like Artifacts With Embedded Defects), sorts the rest. 49.3% left at least one exploit path open, 20.1% fixed the bug by changing what the application does, like flipping allow-list logic to deny-list, and a small slice introduced a fresh flaw. Each clean patch cost about $6.74, failed attempts included.
What moved the result most was the input. Correct guidance lifted success to 65%, no guidance landed at 50.4%, and wrong guidance dropped it to 15.2%, below giving the model nothing at all. Human developers tend to catch a bad hint while reasoning through the code, while the model followed it off a cliff.
The same week showed how far ahead the breaking side runs. PortSwigger's James Kettle built an AI system that invented novel HTTP desync techniques, generating 30,000 candidate attack vectors from 138 RFCs and finding roughly 700 vulnerable targets, with a single trigger exposing more than 200 sites including a US bank. Trail of Bits pointed Codex at hardened code and surfaced a Rust soundness hole, now fixed in Rust 1.98, plus two privilege-escalation bugs in Keycloak's SAML handling. Finding and breaking scale cleanly, while fixing still stalls near one in four.
Takeaways
A wrong hint scored worse (15%) than no hint at all (50%), so the real risk lives in any pipeline that feeds an AI patcher unverified context and ships what comes back. Gate every patch that changes application behavior behind a human diff, because one in five of these "fixes" did exactly that while still looking like a fix.
The Agent's Toolchain Is the New Supply Chain
Researchers documented a campaign called AgentBaiting, spanning 7,600 malicious GitHub repositories with over 14 million downloads, more than 800 of them posing as AI Skills or MCP servers that impersonate brands like Databricks and Salesforce. The twist is how they spread. Major coding agents including Claude Code and Gemini discovered the fake capabilities on their own and treated the attacker's README as legitimate documentation. No human clicked a bad link; the agent went looking.
The npm ecosystem got its own reminder. The active Shai-Hulud worm compromised Keyv and related packages, stealing npm and AWS tokens as it spread. Defenders answered on the same surface. GitHub extended malware advisories from npm to eight ecosystems by building on OpenSSF's malicious-packages data, so a hostile PyPI or Maven package now trips the same alert an npm one does.
For a year the worry about coding agents centered on what they write. This week points at what they reach for. An autonomous agent that installs a skill, wires up an MCP server, or pulls a dependency without a person in the loop has expanded the attack surface to everything it can find and trust.
Takeaways
Treat every skill, MCP server, and package your agents can reach like a production dependency: allowlist it, require provenance, and block silent auto-install. AgentBaiting worked because the agent, not a person, decided what was safe to trust.
Two Build-Chain Flaws Under Active Attack
While the AI stories ran, two pieces of infrastructure came under active attack. N-able confirmed that attackers exploited a critical N-central zero-day (CVE-2026-18577) to reach customer networks through the platform's Take Control feature, then registered Cloudflare Tunnels to hold their foothold after being evicted. Days after its first emergency fix, N-able shipped a second hotfix (build 2026.3.1.10) with extra hardening and told on-premises customers to install it even if they already applied the first, while CISA added the flaw to its Known Exploited Vulnerabilities catalog on an unusually short three-day deadline. N-central is a managed-services platform, so one compromised server opens a path into every downstream customer it administers.
CISA also flagged a JetBrains TeamCity RCE (CVE-2026-63077) under active exploitation, with a federal patch deadline of August 8. A build server holds source code and the credentials that ship it, which is why an unauthenticated RCE there gets treated as an emergency rather than a routine backlog item.
Takeaways
Installing the first N-central hotfix was not the finish line, because N-able now requires build 2026.3.1.10; anyone exploited before it should hunt for the cloudflared tunnels and rogue Take Control sessions the attackers left behind. TeamCity is the same on-call team's next deadline, August 8.
Vulnerabilities in the Wild
By the numbers: 12 notable flaws tracked | 2 under active exploitation | 2 zero-days
Critical / Actively Exploited
N-able N-central authentication bypass, "god mode" (CVE-2026-18577)
Unauthenticated admin access to the RMM platform; attackers used the Take Control feature to reach managed endpoints and registered Cloudflare Tunnels for persistence. Fix is build 2026.3.1.10 (Hotfix 2, required even if Hotfix 1 was applied). Added to CISA KEV. The Register
JetBrains TeamCity unauthenticated RCE (CVE-2026-63077)
Remote code execution without auth on a CI/CD server that holds source and deploy credentials. CISA federal patch deadline of August 8. The Hacker News
High
WordPress pre-auth reflected XSS, CVSS 8.9 (CVE-2026-64638)
Affects every WordPress version; chainable to PHP code execution when a logged-in admin hits an attacker-controlled page. Patch available. The Hacker News
Apache Traffic Server zero-day (HTTP desync)
Surfaced by PortSwigger's AI-assisted HTTP Terminator research during novel desync work. The Hacker News
18-year-old Linux SCTP flaw (local root and container escape)
Long-standing kernel SCTP bug lets local users gain root and break out of containers. The Hacker News
Chrome 151 critical fixes
Google shipped Chrome 151 patching multiple critical memory-safety flaws; update now. SecurityWeek
Critical Paperclip flaw (admin access and code execution)
Allowed administrative takeover and code execution; patched. SecurityWeek
AI-agent tool-invocation flaws (AWS, Google, Vercel)
Attackers could trigger agent tools without invoking the underlying model; all three vendors patched. The Hacker News
Claude Code and Gemini CLI flaws (GitHub issue reaches CI secrets)
A crafted GitHub issue could reach CI workflow secrets through the coding-agent CLIs; patched. The Hacker News
Medium / Research
TONTOU CPU attack (Spectre v2 bypass)
Bypasses Spectre v2 fixes and leaks Linux password hashes. BleepingComputer
Interrupt Injection attack (Spectre v2 bypass on Intel and AMD)
New interrupt-injection technique defeats Spectre v2 defenses across both vendors. The Hacker News
Oracle Database malware via SQL injection
Attackers hid malware inside an Oracle Database following a SQL injection breach. CSO Online
Curated Reading List
Thought-Provoking
A few notes on AWS Nitro Enclaves: KMS integration (Trail of Bits) Why it's worth your time. Catalogs real attack classes against the enclave-to-KMS channel and discloses SDK bugs, the primary-source depth aggregators skip.
CRLF-Powered Desync Attacks: Beheading HTTP Streams (PortSwigger) Why it's worth your time. The research paper behind this week's HTTP desync headlines, arguing header injection is far more dangerous than its reputation.
The AI-Native Company (Daniel Miessler) Why it's worth your time. A frame for where agent adoption is heading, and why this week's failing controls matter more as companies restructure around agent workflows.
Current Events
Tame Dependabot: group your updates, slow the cadence, keep security fast (GitHub) Why it's worth your time. A concrete config pattern for the update-noise that buries real fixes, from a repo where one in six commits was a Dependabot bump.
tl;dr sec #340 (Clint Gibler) Why it's worth your time. Curated roundup with the agent sandbox-escape reporting, agentic incident-response notebooks, and Figma's AI code scanning.
