How OpenAI’s Agents Broke Out of Their Sandbox
OpenAI’s red-team agents found escape routes through microVMs and trusted services. What do those failures reveal about containing frontier AI?
A Malicious AGENTS.md Turned Up in a Customer's Downloads Folder -- In Forever Security's Tests, Codex Rewrote Its Own Machine-Wide Config, and a CLAUDE.md Variant Leaked Claude Code's Login Token
Forever Security's October 22 report, covered by BleepingComputer on October 25, describes an instruction file in a folder the web can write to. Agents launched there treat it as project guidance. The success rates come from the vendor's own tests, and there is no software bug to patch.
India's IT Secretary Says AI Legislation Focused on Safety Is Coming and Blames Many Rogue-Agent Incidents on Poor Cyber Hygiene -- and Puts 23,000 More Government GPUs Online by March 2027
Speaking on October 23, S. Krishnan said the Centre now sees a need for more AI regulation and is working on safety-focused legislation, ahead of a consultation paper promised for early November. He also said 13,000 government-procured GPUs and 10,000 GPU-equivalents from a UAE agreement should be operational by March 2027.
Block's Dessa Is a Full-Duplex Voice Model Trained Only on Recorded Conversation -- One GB200 NVL72, Runs on a MacBook Pro, and So Far There Are No Weights, Paper or Benchmarks
A small research lab at Block announced Dessa on October 23. It is a speech-to-speech model that listens and talks at the same time, trained from scratch with no text and no pretrained models. Access is limited to a waitlist and an early-access programme for safety researchers, so every capability claim is still Block's own.
Framework Watch: LangGraph 1.2.17 Stops Dropping a Recursion Limit Equal to the Default, Pydantic AI 2.61 Closes Guardrail Fail-Open Paths, Ollama Adds Decision Models, and LiteLLM Backports Scanner Fixes to Four Lines
Releases published October 24 and 25. Several fixes are the same kind of bug: a control that looked configured was silently not applied. A loop limit, a guardrail verdict, a browser blocklist and even a community invite link all needed fixing.
Research Radar: On a Live-Web Deep Search Benchmark the Best Model Scores 39% and Humans 21%, SCOPE Compiles Agent Policies Into Programs Small Models Can Run, and RouteWeaver Learns When to Go Agentic
Three more preprints from Hugging Face Daily Papers for October 23; no new lists appeared over the weekend. One evaluates agents on the open web rather than a frozen corpus. One turns a written policy into verifiable predicates. One teaches a router to choose between single-call, multi-round and agentic execution.
Trend Watch: The Control Was Configured, It Just Was Not Enforced -- Allowed Services Became Exits, a Web-Writable Folder Became Trusted, and Limits and Blocklists Fell Through on Edge Cases
This week's containment reports and framework fixes describe the same failure at different scales. A boundary that exists in configuration stops applying under a condition nobody tested. As agents get better at finding those conditions, testing whether controls are enforced becomes the core security exercise.
Wiz's Gheist Report: Stolen GitHub Tokens Planted More Than 13,500 Secret-Dumping Workflow Branches -- Base32 Slipped Past Log Masking, and the Runner Sweep Looks for AI Provider Keys
Wiz Research published its account of the Gheist campaign on October 25. Stolen tokens commit a small workflow to every reachable repository, print the secrets in an encoded form GitHub does not mask, download the log and delete the run. GitHub's approval hold stopped it on public repositories; private repositories and self-hosted runners were the exposed surface.
JetBrains ThinkRail: An Apache-2.0 Incubator IDE That Gives Each Coding-Agent Task Its Own Git Worktree and Keeps a Graph of SPEC.md Files Beside the Code
ThinkRail, a JetBrains incubator project built around the open pi coding agent, shipped nightly 0.3.0-nightly.6 on October 25 and was on the Hacker News front page when this digest checked it. Its two ideas worth borrowing are isolated worktree workspaces for parallel agents and specs the agent maintains as files.
A 2015 CNN Fine-Tuned for About Twenty Minutes Beat GPT-6 Astra and Claude Fable 5.1 at Naming Skin Lesions -- but at Its Preset Threshold It Would Have Discharged 18 of 30 Melanomas
An October 25 write-up by a consultant dermatologist compared two frontier LLMs with a fine-tuned Inception v3 on 200 biopsy-proven lesions. The old specialist network named lesions far more accurately. The LLMs, meanwhile, almost never let a cancer go, at the cost of sending most harmless lesions back for review.
Handling Empty Agent Replies Without Creating False Completion Reports
Distinguish transport success, usable output and completed work, with bounded recovery and an explicit contract for reports.
Pausing an Agent Workflow for Human Input: Request Identity, Validation and Safe Resume
Record an input request, correlate its answer and validate authority before an interrupted workflow continues.
Evaluating Credential-Leak Detectors: Token Shape, Parameter Order and Exact Exclusions
Build a synthetic evaluation corpus that separates format coverage, serialization changes and fixture exclusions so detector upgrades produce interpretable results.