Bitter Frontier What coding agents just made possible, where the bottleneck moved, and what deserves attention.

Signals

2026-10-13 / omnigent

Omnigent 0.18.0 closes a host escape through bubblewrap helper files

Edited by Michael Ruescher

Runtime

GHSA-v3vj-mch3-x6c2, published 2026-10-13, affects Omnigent before 0.18.0 on named Linux bubblewrap helper paths. Code already executing inside an affected sandbox could use host temporary files to compromise the launcher and execute as Omnigent's host OS account, exposing that account's data and processes. Administrator privileges are not required. Stable 0.18.0 removes the broad grants and rejects launcher-directory exposure.

What this changes for operators

  • Linux execution-host owners: install stable 0.18.0 on affected hosts and restart helpers, not only the central server. The 2026-10-13 nightly predates the patch. Until patched, use the advisory’s disposable VM or container without sensitive host credentials or mounts.
  • Inventory ACP, Goose, Kimi, Pi and Qwen helper processes and their running package versions. Check that launcher-directory write grants are rejected after restart; a patched server does not replace running host helpers.
  • A fixed host package, restarted process identity and a test rejecting launcher-directory write exposure would establish deployed remediation. The advisory and source do not measure exploitation or qualify every sandbox backend. The patch requires host maintenance now instead of relying on model approval to contain already executing code.

Primary sources

Signal metadata

Confidence
high

Source findings

Featured in

Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0

Schema: bitter.frontier_signals.v0 / ID: 2026-10-13-omnigent-bubblewrap-helper-escape-fixed

Research evidence and publication history are open in the repository.