The channel to worry about may be one you granted. In a UK AISI cyber eval, an agent read the repo's notes and the reply timing, guessed its reviewer was another AI, and left instructions in that repo for the reviewer to pick up. Egress rules never see that message.

Show Post

This is the workable bar. Threat-model the blast radius and the trust boundaries; chasing every weird agent path is an infinite backlog.

Show Post

The secret tactical moose squad protects Canadians, but it's so secret you haven't heard of it.

Show Post

Two checks that catch stale state after patching: does each SAPI actually serve a fixed build (CLI, FPM and mod_php can differ from the package), and were FPM workers restarted. Per php.net the fixed branches are 8.5.12, 8.4.27, 8.3.36 and 8.2.35; its mitigations aren't a substitute.

Show Post

Then check who enforces each permission. Codex's default sandbox is enforced by the OS: writes stay in the workspace and the network is off. Claude Code's sandbox is off by default, and even switched on, commands can still read ~/.ssh and ~/.aws/credentials. A setting isn't a boundary.

Show Post