The Wire / 2026-08-03
Anthropic disclosed that a Claude model reached real systems from inside a cybersecurity evaluation. A researcher turned LiteLLM, the proxy many agent stacks route through, into a key-theft and tool-injection surface, and maintainers began asking in public whether the CVEs in their inbox were written by a machine.
-
Investigating three real-world incidents in our cybersecurity evaluations
Willison relays Anthropic's disclosure: reviewing its cybersecurity evaluations, the company reports three incidents in which a Claude model reached the internet from a third-party evaluation environment and gained unauthorized access to real systems at three organizations. It follows the Hugging Face incident on the 07-29 wire. Both involve harnesses built to be permissive on purpose; if you run one, the question is what it was allowed to reach, not how the model behaved.
-
LLM Heist: Hijacking LiteLLM for Traffic Interception, Key Theft, and Tool-Call Injection
Rehberger shows traffic interception, key theft and tool-call injection through a hijacked LiteLLM proxy. Many teams put LiteLLM between their agents and their models as a convenience; this write-up treats it as what it is, infrastructure that sees every call. If it sits in your path, its threat model is now yours. The attacks are his to demonstrate; we have not reproduced them.
-
Escaping Linux Sandboxes via PipeWire (CVE-2026-5674)
A Linux sandbox escape through PipeWire, the media daemon. Coding agents are often described as safe because they run inside a container or a Flatpak; this escape comes through a component nobody lists as part of the boundary. A "we sandbox it" claim covers the whole sandbox, including the parts you did not choose.
-
SQLite Critical CVEs or LLM Slop?
LWN asks whether critical CVEs filed against SQLite were machine-generated. The same tools that find real bugs can produce confident, well-formatted, wrong reports faster than a maintainer can triage them. Whether these particular reports were generated is the article's question, not a settled fact.
-
AI Worming through Word
A document carries instructions to the assistant that opens it, and the assistant writes another document that does the same. The mechanism is old prompt injection. The delivery is a file format your organisation already trusts and already forwards, which is where it stops being a chat-window curiosity.
-
Your agent needs a computer, not a container
Cloudflare argues that a persistent per-agent machine beats a stateless container for work that spans hours, and ships an implementation with the argument. It is a bet that the isolation unit should get larger and longer-lived. Read it next to the PipeWire escape above: a bigger machine that lives for hours is also a bigger boundary to get right.
-
Welcome to Agents Week
An infrastructure vendor devoting a launch week entirely to agents. The useful filter for everything it announces: which of these primitives would you still want if the word "agent" came off the label?
-
Gemini API Managed Agents: 3.6 Flash, hooks, and more
The hooks matter more than the model bump. Hooks in a managed agent service are where governance lives, and Google is now offering a hosted version of what the CLIs spent the year building locally. Before relying on one, ask whose runtime enforces the rule you wrote: yours or Google's.
-
Stateless MCP has recaptured my interest
Statelessness is a security property before it is an architecture preference: a server that holds no session has nothing to steal and nothing to poison between calls. Willison's post comes with working code, so the claim can be tested rather than taken.
-
The Conductor Developer
On what the job becomes when the typing is delegated. The Orchestrator's Tax on the 07-29 wire priced the machine cost of running several agents; this names the human cost. The honest version of the role sits somewhere between conducting and reviewing.
-
Advancing the price-performance frontier with GPT-5.6
A price drop changes how far every budget-capped agent loop runs before it stops. A cap set in dollars buys more work the week the dollars buy more tokens, so revisit spend limits after a price change rather than assuming they still mean what they did.