Caleb Gross retweeted
I am evaluating secure sandbox surfaces for high-trust agent environments (benchmarking, SFT, expert on-policy supervision, outcome based RL, etc). Obviously there are some pre-baked solutions, one that is attractive is Docker's sbx (docker.com/products/docker-s…).
Sbx runs agents inside isolated Linux microVM's with their own kernel and private Docker Engine. They use filesystem passthroughs and host-side bridges to facilitate file access, networking, mcp tool usage, credentials, etc. These microVM's offer a very strong execution boundary but obviously the brokers are a major attack surface.
Looking through the changelog for sbx, the situation is a bit more grim than you would expect. Between June 1 and today (Oct 24) there are 9 CVE's including critical issues (like a macOS virtio-fs escape CVE-2026-77179). These look like typical logic issues you might expect. What's interesting though is that the changelogs also reveal areas that got security fixes but no CVE. For example, a full broker mediated guest-to-host escape, shown in the poc below (on v0.39.0 before Sept 7). Some light reverse engineering was required since you don't get core implementation source.
Pre-patch a sandbox could supply DBUS_SESSION_BUS_ADDRESS through the guest-controlled host_env sent to the host browser bridge. On the Linux host, the bridge passed that environment to xdg-open, whose desktop-detection path invoked dbus-send, which accepts a "unixexec:" address leading to code execution.
Caleb Gross retweeted
We're thrilled to have contributed a V8 vulnerability to one of this year's four $250K Chrome full chain exploits. The vulnerability was subtle enough that Google needed multiple commits to finally fix it.
However, we would like to take a step further. To convince Fortune to smile upon us deterministically. We managed to use LLM-assisted formal verification to rediscover the bug. The same approach can prove security properties of functions and APIs.
Will share writeup and more about formal verification work soon. We will build more Chrome full chains!
We just received a $250,000 Chrome Full Chain bonus! 🎉
We've claimed the second Full Chain bonus of 2026. Only two remain!
Under the rules, every vulnerability had to be a non-duplicate 0-day, and the entire exploit chain had to be completed before any of them were patched.
Huge thanks to @nebusecurity for discovering a V8 vulnerability in just a single day! Also, a big thank you to @_deayzl for collaborating with me on the V8 Heap Sandbox research.
P.S. KVM escapes have been getting a lot of attention. I actually captured the Full VM Escape flag in KVMCTF about three months ago. Hopefully, I'll be able to share that research soon, too!
Caleb Gross retweeted
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: xitter.cf/lcfr_hax/status/208503…
His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
Caleb Gross retweeted
Attack surface reduction is the one thing that reliably works.
Reducing the attack surface of deployed services and apps is a fundamental component of software that is secure by design. Earlier this year we tasked Claude with autonomously mapping and reducing the attack surface of 25 large and widely used OSS codebases. This blog post covers some of our methodology and a preview of the data we collected.
This research resulted in a significant reduction in OpenSSH pre-authentication attack surface (now fixed in 10.6). And over 500 findings where reachability could be reduced and configurations hardened to ensure security controls weren’t silently disabled.
anthropic.com/research/attac…
Caleb Gross retweeted
Just watched the @netflix Instadocs about the @OpenAI cyberattack on @huggingface. Super disappointing, as they went for maximum anthropomorphism of the technology and full doomer mode.
I spent more than two hours with them trying to correct all their mistakes and ground this in reality, explaining that agents are technological systems, not aliens. But it looks like the drive to scare people for maximum views was too strong.
Also, they didn’t mention the lack of containment and monitoring of the agents, how closed-model safeguards blocked our defensive work, or how we defended ourselves with AI using an open model. And that we still lack a lot of information and transparency, including full agent traces and that companies need to remain accountable for what their agents do.
It ends up being a fun sci-fi movie though!
Caleb Gross retweeted
I found two Windows 0-days with a frontier model, the first in 76 minutes. Then I replayed the same hunt on Qwen, DS4, GLM and more.
How much frontier capability survives on local models, and how much human direction does it take?
“To the Frontier and Back Again” @UnpromptedAU
Caleb Gross retweeted
Context about how I got CVE-2026-99999: it wasn't assigned by incrimental luck. There were nearly 2k unassigned CVEs before it. The Linux maintainers felt it deserved the special number because of impact+new attack surface for KVM escapes and offered it. It was a prize! I was just telling someone it feels like graduation from cybersecurity. So yeah it's intentionally assigned, and I'll be eternally grateful for it.
Caleb Gross retweeted
As a treat, Claude also reverse engineered the NBS's 1977 DES S-box test vectors and determined that it was generated on a PDP-11 Unix V6 using rand() .
CLAUDE FOUND THE SEEDS
anthropic.com/research/ecdsa…
Caleb Gross retweeted
We aren’t really in a world of what “works”. We’re in the part of the movie where you need to throw whatever you can in the path of the zombies and hope it slows them down.
Caleb Gross retweeted
The details of the long awaited KVM Escape are published. PwnEscape leads to VM escapes across multiple hypervisors due to a super cool Linux networking bug.
CVE-2026-99999 is a 9.3 CVSS critical rated KVM escape ⛓️
pwn.ai/blog/pwnescape
Caleb Gross retweeted
My dad had a mug labeled "the stupidest programmer has the largest program" - I inherited the mug. In times of AI slop, this is truer than ever.
I really wish I could get AIs to write *less* code to achieve the same thing.
For most PRs I want to run a loop "please cut all fat".
Caleb Gross retweeted
Tomorrow the vulnerability details for the coolest (imo) KVM escape will drop. The Vercel team was amazing to work with and has been an incredible partner throughout this journey!
This is one of the most exhilarating times in technology, and this challenge was yet another jaw-dropping moment.
When the details of OpenAI’s agent escape and Hugging Face hack started to emerge, it became clear that agent containment would be one of the most important priorities for any AI infra company.
There are two classes of escapes: ① "escape the network" and ② “escape the matrix” 😁, as in, break the spell of virtualization. OpenAI was the former, where an agent not supposed to have internet access… gained it by hacking another system. Genuinely astonishing and worrisome.
Through this challenge, however, we discovered something even more groundbreaking. A talented white-hat researcher, armed with a swarm of AI agents, expertise and perseverance, "pierced through" the Linux virtualization boundary that nearly every cloud sandbox provider in the world banks on today.
I'm very thankful we got the report, were able to quickly move to protect our customers, found no evidence of customer data compromise, and collaborated with many industry partners to protect the wider internet.
Our confidence and conviction in Vercel Sandbox are even greater now, after some of the smartest, most motivated researchers in the world, and their agents, gave it their best shot.
