Nineteen posts in 10 days, with the sandbox-containment ones doing most of the work.
Three separate agent sandboxes turned out not to be sandboxes. Check Point found ChatGPT containers sharing internal infrastructure, and a related write-up covered cross-account traffic through a shared JFrog Artifactory instance. Then DeepSeek Harness shipped a bug letting a confined agent disable its own confinement with one curl command. On the more theoretical end, Intuition Machines pitched data diodes as a training boundary, which is a reasonable idea nobody has an incentive to adopt.
Microsoft’s Patch Tuesday carried 974 CVEs. That is not a typo, and it does invert the usual complaint: defenders now have more patches than they can triage.
METR disclosed a March incident where an attacker asked an agent for its API key and got it, then spent $600K of credits. Elsewhere in the agents-doing-crime file, a Russian-speaking actor used AI agents to compromise 395 organizations via PaperCut, and Google caught attackers standing up credential-harvesting pipelines in under six hours.
Two claims got trimmed rather than amplified. The Cyberkimi 24-hour Chrome exploit ran with --no-sandbox and matched no CVE. And the BlueMoon exploit kit has only circumstantial evidence of AI involvement; what it does have is a patch gap.