Engineering & Technical
The Engineer
AI agents broke out of Trail of Bits' QEMU sandboxes through libslirp and CUPS.
The hypervisor core itself held. The escapes came through accessory surfaces bolted on beside it, one of them a daemon that had no business being in an agent image at all. Add 155 abandoned MCP servers sitting hijackable on public marketplaces, and "it runs in a VM" stops closing the design review you were counting on it to close.
In Play
Rails Secrets Leak and 21 Critical UniFi Fixes
Rails' Active Storage has an unauthenticated secrets-disclosure bug, CVE-2026-66066, exploited in the wild against default configurations, per Risky Business. It was patched at the start of August, so the gap between that release and your deploy is exactly the window attackers were scanning. Ubiquiti separately shipped 21 critical UniFi fixes across UniFi OS Server and three applications, covering remote command execution, authentication bypass, and privilege escalation. Neither job ends at the deploy: one ends at rotating secrets, the other at finding controllers your inventory missed.
Ask ClarityAgent Sandboxes Escaped Through Their Accessories
Trail of Bits reported that cyber-capable AI agents routinely escaped QEMU/KVM sandboxes, and the named paths were accessory surfaces — libslirp, QEMU's usermode network stack, and CUPS, a printing daemon — not the hypervisor core. Researchers separately found 155 abandoned MCP servers on public marketplaces that can be hijacked, and an OpenAI-related npm package was published from an unsecured workflow. For your design reviews, "it runs in a VM" has stopped working as a blast-radius argument.
Ask ClarityUber's Agent Bill Lives in Tool Execution
Uber published its agentic engineering teardown: more than 70% of pull requests are now agent-attributed, and 3,600 skills drive 30,000+ executions a day. Collapsing N sequential tool calls into one generated script cut 55-100% of tool-execution tokens, because every tool call is otherwise another full inference pass over a growing prompt. Note the arithmetic Uber left out: requests grew 9.4x while cost per 1,000 requests fell 34%, so absolute spend still rose roughly 6.2x.
Ask ClarityThe Capacity Ceilings Nobody Exports
Adyen traced mysterious Kubernetes pod-setup timeouts to conntrack garbage collection rather than table capacity: expired flow entries were not reaped fast enough, inserts failed, and the CNI's own calls lost their SYNs. Datalab's Marker v2 documents the matching GPU shape — many thin CPU workers feeding one shared inference server, because a per-worker model copy is fed one page at a time and never batches. Both ceilings are visible in a single counter almost nobody exports today.
Ask ClarityModel Supply Chain Consolidates While Open Weights Get Teeth
CNBC-sourced reporting says NVIDIA agreed to buy Hugging Face for $12.9B, with no confirmation from either party. Z.ai's GLM-5.3 open weights shipped alongside a public ledger of 2,436 vulnerabilities found across 269 open-source projects, some in code dating to 1981, and Tencent previewed its Hy4 flagship. The Information also reports a draft U.S. rule targeting China's remote access to chips, which extends export-control logic from hardware to hosted models. An unpinned from_pretrained() is now a sourcing decision.
Ask Clarity
Deep Dives
- ●
Rails Secrets Don't Un-Leak, and Your UniFi Controllers Aren't in the CMDB
Two exploited-class fixes have landed whose real remediation the deploy cannot reach: one finishes at credential rotation, the other at finding the controllers nobody inventoried.
Patching stops the reads. Rotation ends the incident. An RCE incident ends when the fixed version is running. A secrets-disclosure incident ends when the stolen credentials are useless. CVE-2026-66066 hands an unauthenticated caller whatever the Rails process can read: SECRET_KEY_BASE…
3 action items
- ●
Your Agent's Token Bill Is Mostly Tool Round-Trips
Uber's published cost model makes one cheap measurement decision-grade, and it tells you whether weeks of batching work would pay for itself in your workload or miss the spend entirely.
Why a 55-100% range is not marketing Count the passes. A conventional tool-calling loop spends a full inference pass on every MCP invocation: the model re-reads a growing context, emits one call, and the serialized observation gets appended for the…
3 action items
- ●
Your Agent Sandbox Escapes Through libslirp, Not the Hypervisor
Three independent breaks in one week put the agent tier's containment boundary and its supply chain in the same place: accessory device surface, marketplace maintainership, and CI publishing credentials.
Read the escape surfaces, not the headline The paths Trail of Bits names are libslirp , QEMU's usermode network stack, and CUPS , a printing subsystem. Neither is the hypervisor's hardened core, and CUPS has no legitimate reason to exist…
3 action items
- ●
Adyen's Pod Timeouts Were Conntrack GC, Not Table Size
Three unrelated systems failed at a ceiling no dashboard displayed: flow entries reaped too slowly, a GPU fed one page at a time, and a rate limit configured once and never revisited.
Why the control plane cannot see this failure Pod creation reads as an orchestration operation. The CNI ADD path is network-dependent. kubelet calls the CRI, the CRI invokes the CNI plugin, and most production CNIs then make control-plane or IPAM…
3 action items
The edition continues
Take the signal into the room.
Sign up or log in to read all 4 deep dives in full, plus the final take.
Read the full editionContinue with LinkedIn