omnigent
Sourced signals for omnigent: release changes, governance moves, runtime shifts, and operator consequences. Each links to the run that produced it. The omnigent profile carries the current evergreen state.
October 2026
-
Omnigent 0.18.0 closes a host escape through bubblewrap helper files
- Linux execution-host owners: install stable 0.18.0 on affected hosts and restart helpers, not only the central server. The 2026-10-13 nightly predates the patch. Until patched, use the advisory's disposable VM or container without sensitive host credentials or mounts.
- Inventory ACP, Goose, Kimi, Pi and Qwen helper processes and their running package versions. Check that launcher-directory write grants are rejected after restart; a patched server does not replace running host helpers.
- A fixed host package, restarted process identity and a test rejecting launcher-directory write exposure would establish deployed remediation. The advisory and source do not measure exploitation or qualify every sandbox backend. The patch requires host maintenance now instead of relying on model approval to contain already executing code.
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
September 2026
-
When Omnigent's policy server is down, the wrapped harness decides
- Upgrade shared Omnigent servers to v0.14.0. Anyone who can upload an agent bundle could get a host shell before it.
- Know which layer refuses: during a policy-server outage your Omnigent deny rules do not apply to native tool calls; the harness's permission mode does. Set that mode as if Omnigent were absent.
- Evidence that would settle residual: a tag containing the editor shell-proxy fix (#7619), which reached v0.15.0 on 2026-09-22, after this window.
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
August 2026
-
Omnigent's spend cap is enforced before the call, and is a downgrade gate rather than a ceiling
- An operator who sets max_cost_usd expecting spend to stop at that number has not configured that. Spend continues past the cap on any model outside expensive_models. Set the cap and the expensive_models list together, and treat the number as the point where the session gets cheaper rather than the point where it ends.
Run: 2026-08-03-weekly-digest-2026-07-27_2026-08-03-frontier-v0
-
The only write confinement for Omnigent's unsandboxed workers did not bind on Windows
- The fix is on main and in no tag: v0.7.0 was published 2026-07-27, six days before the fix merged, and is still the newest release. An operator running the tagged release with unsandboxed implementer workers on a Windows runner does not have absolute-path confinement. Run main, or do not run those worker specs on Windows until the next tag.
Run: 2026-08-03-weekly-digest-2026-07-27_2026-08-03-frontier-v0