DeepSeek Reveals How AI Agents Exploit Their Sandboxes
DeepSeek published research showing how autonomous agents find ways to escape or exploit the constraints of their own sandboxed execution environments.
AI Daily Recap
22 articles · 6 categories
The finishable daily brief
What happened in AI — Sep 25, 2026
Friday, Sep 25, 2026
22 articles · 6 categories
read top to bottom · then stop
In 30 seconds
- Agent security had a rough day: DeepSeek documented sandbox exploits, researchers breached retailers for $25/target, and one coding agent deleted an entire main branch.
- MCP keeps maturing: AWS details a stateless spec update that drops sticky-session requirements for remote servers.
- Coding agents are proving ROI: Proaction credits Codex, GPT-Live-1, and GPT-6 Astra for a 60% sales lift.
- New tools target the agent-ops gap: Executor demands proof of work, AtlasBurn tracks and kills runaway agent spend.
- Cognition (maker of Devin) is reportedly nearing $1B in annualized revenue.
- Meta's Muse gives every user a persistent, full Linux VM — an ambitious bet on agent infrastructure.
Today's clearest signal is agent security cutting both ways: DeepSeek published research on agents escaping their own sandboxes, researchers showed retailer break-ins for about $25 per target, and one developer watched a coding agent wipe an entire main branch.
Underneath that, the plumbing keeps maturing — MCP shed its session-affinity requirements, LangGraph-style orchestration is shipping in production, and Cognition is reportedly closing in on $1B in annualized revenue.
Agent Security: Exploits, Attacks & Failures 5 items
Today's clearest engineering signal: agents are now capable enough to cause real damage, whether wielded by attackers, exploited through their own sandboxes, or misconfigured by their operators.
AI Agents are breaking into Online Retailers for $25 a target
Security researchers demonstrated autonomous agents compromising online retailers end-to-end for roughly $25 per target, underscoring how cheap agent-driven attacks have become.
My coding agent pushed a commit deleting every file on main
A developer's coding agent pushed a commit that deleted every file on the main branch, a reminder that agent write-access to production repos needs hard guardrails.
Show HN: Can an AI agent bypass a post-quantum signed authorization policy?
A Show HN challenge invites builders to try breaking an authorization scheme secured with post-quantum signatures using an AI agent, testing whether current agents can defeat next-gen crypto-backed access control.
Agents can now set up your website's security with Turnstile Spin
Cloudflare's Turnstile Spin uses a coding agent to auto-wire the server-side validation sites often skip, closing a common bot-protection misconfiguration.
Agent Runtimes, Orchestration & MCP 4 items
Production agent stacks are consolidating around LangGraph-style orchestration and a maturing MCP protocol that is shedding stateful session requirements.
Building Production Agents with Jev and LangGraph
TypeSafe AI's Jev decision model runs on LangGraph orchestration to cut cost and latency in production agent deployments.
From Data to Dialogue: How S&P Global Energy Made Its Structured Data Estate Conversational with Databricks Genie Agents and MCP
S&P Global Energy rebuilt its structured-data estate as a conversational interface using Databricks Genie Agents connected over MCP.
Stateless MCP Removes Session Affinity Requirements for AWS Server Deployments
The latest MCP spec drops protocol-level sessions and sticky-session requirements, letting AWS route each MCP request independently instead of pinning clients to one server.
The Agent Harness: What It Is and Two Ways to Build One
A hands-on comparison builds the same finance-assistant agent harness twice — once on AWS AgentCore, once on LangChain with Envoy AI Gateway — to contrast how each handles the operational plumbing.
Evaluating & Controlling Production Agents 3 items
New tools are answering two operational questions agents still can't answer for themselves: did the work actually succeed, and what did it cost.
Show HN: Stop shipping AI slop, Executor makes agents prove it works
Executor requires agents to produce verifiable proof of completed work instead of just reporting success, aiming to catch silent failures before they ship.
From Agent Authorization to AI Production Evaluation: QCon AI New York 2026
QCon AI New York's 23 confirmed sessions center on agent authorization, production guardrails, and post-deployment evaluation — the operational half of agent engineering.
Show HN: AtlasBurn – Know what your AI costs and stop runaway agents
AtlasBurn tracks per-agent spend in real time and can kill runaway agent loops before they burn through budget.
Developer Tools & Coding Agents 3 items
Coding-agent tooling keeps pushing into measurable business outcomes and into observability for the agents themselves.
Proaction boosts sales 60% and saves 75+ hours with Codex
Fleet-management startup Proaction says building on Codex, GPT-Live-1, and GPT-6 Astra lifted sales 60% and saved over 75 hours of engineering time.
GitHub Copilot app for Beginners: How to build custom workflows with canvases
GitHub Copilot's new canvas workflows let you describe an interface in plain English and get back a live, editable surface instead of hand-building one.
New in LangSmith: Engine v2, Managed Deep Agents, Fine-Tuning, and more
LangSmith's Engine v2 adds automated red-teaming and testing, alongside an updated Managed Deep Agents offering and trajectory tracing.
AI Infrastructure & Training at Scale 4 items
Infra posts today focus on squeezing more throughput and simpler operations out of large-scale RL training and storage.
Scaling MoE reinforcement learning on Amazon EKS with EFA and DeepEP with 40% more throughput
AWS shows an EKS + EFA + DeepEP architecture that lifts MoE reinforcement-learning throughput 40% over the prior setup.
Best practices guide for customizing Gemini models via Reinforcement Learning (RL)
Google Cloud lays out how external customers can run RL-based customization against proprietary Gemini models without direct access to model internals.
Multi-Region training with Amazon SageMaker HyperPod and Qumulo
SageMaker HyperPod paired with Qumulo lets teams run training compute in one AWS region while keeping the dataset in another, with validated cross-region architecture and results.
Home Made CobbleDB Replaces DynamoDB at Perplexity to Cut Query Latency 5x and Reduce Cloud Storage
Perplexity replaced DynamoDB with CobbleDB, an in-house Rust key-value store, cutting search query latency 5x and reducing storage costs.
Frontier Models, Funding & World Models 3 items
Money and infrastructure keep flowing toward agent-native products, from a coding-agent startup nearing $1B run-rate to Meta's persistent-VM agent platform.
Cognition to hit $1B annualized revenue: report
Devin-maker Cognition is reportedly on pace to hit $1B in annualized revenue.
Quoting John Gruber
Meta's Muse gives each user a persistent, full Linux VM running in Meta's cloud — technically novel agent infrastructure wrapped in an approachable product.
Runway's WorldPrompt and the Engineering of Real-Time Worlds
Runway's WorldPrompt steers a real-time world model, using persistent context and timed actions to generate synchronized video and audio on the fly.
You are caught up for this edition