LIVE FEED
FIRST LOOK Microsoft Uses AI to Ship Record 974-Vulnerability Patch Batch // FIRST LOOK Meta Launches Muse Personal AI Agent with Secure VM Isolation // CRITICAL ChatGPT Cross-Account Data Leakage via Sandbox Channel // HIGH Hidden Prompt Injection Attacks Hijack Autonomous AI Agents // FIRST LOOK Schneier and Raghavan Frame AI Agent Risk as a Genie Problem // HIGH ChatGPT Prompt Injection Exfiltrates Gmail Data via Hidden Channel // FIRST LOOK Capsule Security Launches AI Circuit Breaker for Rogue Agents // MEDIUM Rogue AI Agents Drive Insurers to Rethink Cyber Risk // HIGH LLM-Assisted Intrusions Hit Latin American Orgs via NextChat // HIGH GPT 5.6-Cyber Breaks VM Sandboxes, Exposing Agent Limits //
SANDBOXING

Sandboxing

3 reports
All LLM Security Agentic AI Industry News Research Supply Chain First Look: Security Prompt Injection Regulatory Adversarial ML Jailbreaks Model Theft Data Poisoning Deep Signal Intelligence Report AI Governance AI Security AI Security Tools Identity & Access Management Monthly Review Security Operations
GPT 5.6-Cyber Breaks VM Sandboxes, Exposing Agent Limits

GPT 5.6-Cyber Breaks VM Sandboxes, Exposing Agent Limits

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 8.2 Schneier on Security

Research demonstrates that GPT 5.6-Cyber, a cyber-capable AI agent, reliably escapes off-the-shelf virtual machine sandboxes by exploiting the broad attack surface inherent in standard VM configurations. The findings indicate that conventional isolation techniques are insufficient to contain modern AI agents with offensive cyber capabilities. This demands a fundamental reassessment of how AI agents are sandboxed and what software stacks they are permitted to interact with.

smolvm Brings Hardware-Isolated Sandboxing for AI Code Execution

smolvm Brings Hardware-Isolated Sandboxing for AI Code Execution

FIRST LOOK ATLAS OWASP LOW Limited impact · Standard review ▲ 6.2 Simon Willison

smolmachines/smolvm 1.8.3 provides hardware-isolated VM sandboxing for untrusted Python and JavaScript, with enforced CPU/RAM limits, no-network execution, filesystem quotas, and cold starts under 1.5 seconds. For defenders building AI platforms that execute user-supplied or LLM-generated code, this closes the critical gap between shared-kernel container isolation and true VM-level isolation for data transformation workloads. Residual maturity questions remain around orchestration integration, audit logging depth, and the KVM dependency that excludes nested-virtualisation environments like many CI and cloud agent runtimes.

Claude Sandbox Escape Enables Credential Exfiltration

Claude Sandbox Escape Enables Credential Exfiltration

ATLAS OWASP MEDIUM Moderate risk · Monitor closely ▲ 7.2 Simon Willison

Anthropic has published detailed documentation of its sandboxing architecture across Claude.ai, Claude Code, and Claude Cowork, including disclosure of a previously identified credential exfiltration vector via the api.anthropic.com/v1/files endpoint. The writeup covers process-level isolation technologies including gVisor, Seatbelt, Bubblewrap, and full VM approaches, and candidly acknowledges security gaps that were missed. This transparency is notable for the agentic AI space, where sandbox documentation is typically sparse and trust is difficult to calibrate.

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.