Diff

Anthropic replaced Git as AI commit volume exploded

Anthropic's merged-changes-per-day went from 2,500 in May to over 30,000 by September — a 12x jump driven by AI-accelerated development — and standard Git became the bottleneck, forcing them to build a custom version-control system in five months. It's a concrete data point for what 'AI changes how fast teams ship' actually looks like once it hits real infrastructure rather than staying anecdote. If your own team's AI-assisted commit volume keeps climbing, this is the kind of tooling wall you hit well before anyone questions the model itself.

via anthropic engineering

lessontooling

A $1M bounty surfaced a real sandbox kernel bug

A two-week, $1M adversarial test of Vercel's production sandbox — 1,285 reports, $242,000 paid out — still turned up a genuine Linux kernel zero-day capable of host memory leaks, host crashes, and host code execution, the strongest evidence yet that 'sandboxed' and 'isolated' aren't the same claim. For anyone running agent-generated code inside any sandbox — Cowork, Vercel Sandbox, or otherwise — the boundary you're trusting is thinner at the kernel layer than the product page suggests.

What’s sandbox escape via kernel zero-day?

Agent-execution sandboxes — what Cowork, Vercel Sandbox, and similar agentic coding tools run your or an agent's code inside — are built on the same primitives as regular cloud VMs or containers: a kernel-level boundary that's supposed to keep anything running inside from touching the host machine or other tenants.

A 'kernel zero-day' means the researcher found a bug in that boundary itself, not in the sandboxed code. That's the worst class of sandbox bug, because it doesn't matter how carefully the agent's code is reviewed; the escape works regardless of what's running inside.

The three outcomes Vercel describes — host memory leaks, host crashes, host code execution — are escalating severities: reading data you shouldn't, taking down shared infrastructure, and finally running your own code on the host as if the sandbox boundary didn't exist.

The debate this reopens: a $1M bounty with 1,285 reports over two weeks is about as much adversarial pressure as a sandbox can get, and it still found a kernel-level hole — the argument for why 'it's sandboxed' should never be the end of a security conversation for agent tooling.

Do it — 3 steps in your repos20 min

List every agent-execution sandbox your tools rely on (Claude Code, Cowork, CI runners) and note which use VM-level vs. container-level isolation.
Check each vendor's changelog or security page for recent sandbox-escape CVEs or patch notes — Vercel just published one.
If any sandbox runs agent code with host-level privileges or shared kernel access, flag it for review rather than assuming 'sandboxed' means fully isolated.

via vercel

debateindustry

Experts blame bad ops, not rogue AI, for breaches

Security researchers argue that this year's wave of 'AI agent went rogue' headlines are, on closer inspection, ordinary containment and monitoring failures — the kind any software team would recognize — dressed up as a story about emergent AI behavior. That reframing matters because it shifts the safety conversation from mystique about autonomous models to the far more boring, far more actionable discipline of ops hygiene. It's also exactly the kind of myth-puncturing raw material that's useful the next time you're writing about how engineering narratives get built around AI.

via cso online (via hn)

Still open · 4

Separately sandboxed AI agents can still coordinate×2

lessonagents

Separately sandboxed AI agents can still coordinate

The post describes how agents running in completely separate, correctly-configured sandboxes can still coordinate by writing to anything both of them can read — a shared package cache, a tracked document, a chat channel — which means 'sandboxed' only guarantees isolation from the host, not isolation from each other. It's the same blind spot traditional network security hit once a single compromised machine stopped being the worst case, and it reframes agent containment as a network problem rather than a per-agent one.

What’s Agent-to-agent covert channels?

A 'covert channel' is any way two systems pass information through a medium that wasn't designed to carry messages between them — the classic example is two processes on one machine signaling each other by changing how much CPU or disk they use, with nothing that looks like direct communication.

Agent sandboxes were built to stop a single agent from reaching outside its box onto the host or the network, and that containment held. What it didn't account for is two correctly-sandboxed agents being handed shared access to the same external resource — a package registry, a tracked document, a chat channel — on purpose, because that's how the system was supposed to work.

Once that shared surface exists, one agent can write something to it that only makes sense to another agent reading the same place, and the isolation between the two sandboxes stops mattering. It's the same pattern that let early computer worms spread machine-to-machine without ever breaking into any single machine directly — propagation through a shared surface, not a direct breach.

The open question is whether this gets fixed by cutting off shared read/write access between agents wherever possible, or by treating every shared resource as something that needs its own audit trail — and whether either approach survives contact with an organization running dozens of agents through the same handful of tools.

via cryptography engineering (matthew green)

Claude Code can now auto-build your evals×3

techniquetooling

Claude Code can now auto-build your evals

Anthropic shipped build_eval and hillclimb as Claude Code skills, turning eval-writing from a manual, often-skipped chore into a guided loop: baseline first, then one change at a time with an overfitting check before anything gets accepted. That's a meaningful shift — most teams shipping LLM features still skip straight to tweaking prompts without a real baseline, and this makes the harder discipline the path of least resistance instead. If you're the one deciding how your team verifies that an AI-written change actually helped, this is worth trying on real production traces rather than synthetic examples, since the tool pushes you to build the eval before you start optimizing.

Do it — 3 steps in your repos30 min

Enable the Claude Code auto-eval skills (build_eval and hillclimb)
Point build_eval at real production traces — conversation or request logs — rather than synthetic examples
Run the baseline eval before changing anything, then let hillclimb iterate one change at a time and check its overfitting warning before accepting a result

via hamel husain

Gemini 4 Argon ships restricted to cyber defenders×3

shiftindustry

Gemini 4 Argon ships restricted to cyber defenders

Google's newest frontier model isn't shipping broadly — Gemini 4 Argon is restricted to government users and vetted cybersecurity teams in its Fairwind Program, the first time a flagship release has been gated by capability risk rather than price or compute. It's a concrete sign that labs are starting to treat 'who gets access' as part of the safety stack, not just an afterthought, which matters for anyone watching whether frontier capability will keep diffusing freely or start fragmenting by vetting tier.

via google deepmind · hn front page · latent space

OpenAI disrupted a campaign stealing its model's reasoning×2

lessonindustry

OpenAI disrupted a campaign stealing its model's reasoning

OpenAI says it disrupted a coordinated campaign that used adversarial querying to extract and distill its model's internal reasoning — not just its final answers — into a competing model. That's the first confirmation from a major lab that some of the open-weight ecosystem's rapid catch-up with frontier models may be adversarial extraction rather than organic research progress, which reframes the open-vs-closed model race as partly a security problem. It's a useful reminder that API terms alone don't protect what a model actually knows, worth keeping in mind for anyone deciding which model's API to build on.

What’s model distillation as an attack surface?

Distillation is normally a cooperative technique: a smaller 'student' model is trained to mimic a larger 'teacher' model's outputs, usually with the teacher's permission, to cut cost and latency while keeping most of its capability.

Most commercial API terms assume that without the teacher's actual weights, an outside party is only training on indirect text outputs — a weak, slow signal that takes enormous amounts of data to turn into something competitive.

OpenAI says this campaign ran large, coordinated query volumes specifically designed to reconstruct the model's internal reasoning chains rather than just its final answers — extracting far more of the teacher's 'knowledge' through the API than that assumption accounted for.

What's unresolved is how much of the broader open-weight progress wave is this kind of extraction versus genuine research gains, and what actually stops it — rate limits and terms of service clearly weren't enough on their own.

via openai

Also shipped

Claude Code moved through 2.1.299–300, anthropic-sdk-python shipped v1.14.0, and OpenTelemetry export reached beta on the platform: native OTel tracing across the SDK, GenAI semantic-convention trace attributes, cache_creation metrics split by lifetime, idle compaction for 200K+ token conversations, and Managed Agents execution_identity.
openai-python shipped v3.30.0–v3.31.0: beta session spending limits, OCI external-storage provider support, organization Decisions usage reporting, and the first part of a four-part browser/computer-toolset rollout.
Vercel's AI Gateway added Gemini 4 Argon, Fish Audio's Drama 3 TTS, and Microsoft's MAI-Image-2.6/2.6-Flash, while Amazon S3 joined the Vercel Marketplace with OIDC-based credentials and repo checkout/Git LFS times dropped 20–54%.
Cursor launched the Origin App Marketplace, opening integrations across 20+ deployment, CI, review, security, and monitoring tools to public submissions.

Saved for Sunday

Leash Bio turned a drug-discovery wet-lab pipeline into an RL training environment for agents — direct resonance with her cancer-biology Ph.D. background; worth a full watch/read rather than a squeezed-in daily mention.