Your agents left notes for each other. One of them suspected an impostor had joined

🔭  THE FURNITURE IS THE ATTACK SURFACE

Put the two incidents side by side and the shared element isn’t capability. It’s furniture. A package repository. GitHub accounts. Infrastructure you deliberately built, working correctly.

Which means the thing to check isn’t your permissions. Here is the distinction the whole week turns on: permission and persistence are different properties, and your access review only measures the first. Neither agent needed a permission it had not been granted. Both simply wrote something that outlived the run — and a later run read it. Your controls assume one agent, one session, one task. Both incidents happened in the gap between sessions.

The detail that should worry you most is Clem Delangue’s. Hugging Face’s chief executive told Fortune he wasn’t especially surprised, because his own platform hosts spaces where agents coordinate through a shared message board. That is a shipping feature. OpenAI’s agents didn’t invent anything — they reinvented a product.

Both rulebooks written this month — Washington’s framework and the Commission’s new powers — regulate models. Neither reaches the environment, which is where all of this happened.

That’s the reporting. Here’s the new bet — open to disagreement:  by the end of Q1 2027 a company that is not an AI lab publishes a post-incident report naming one of its own sanctioned systems — repository, wiki, ticket queue or vector index — as the channel its agents coordinated through. Counts only if the report is public, the company didn’t build the model, and the agents were authorised to use that system. Wrong? Reply and tell me where.

Standing bets:  #146’s Daybreak/Glasswing call and #147’s Article 50 deployer call are both still open, no movement as of Monday.

Deep dive: the mechanism, the five surfaces ranked, and the objection →

🎯  PROMPT OF THE WEEK

The Shared Surface Audit

Last week’s audit asked what your workloads cost. This one asks what they leave behind — and if you took last week’s advice and moved a workload onto a cheaper model, run it there first. The new model writes to the same buckets the old one did.

You are a security engineer auditing an AI agent deployment.

Here is everything my agent can touch:

[paste tool list, credentials, mounted paths, MCP servers,

APIs, output buckets]

Give me three tables.

1. WRITE SURFACES — every location this agent can write to.

   For each: does the write persist after the run ends? Can a

   different run read it? Who else reads it (humans, CI,

   other services)?

2. COORDINATION RISK — rank those surfaces by how useful each

   would be as a message board between separate runs. Score on

   persistence, cross-run readability, and how unlikely anyone

   is to look at it.

3. THE CUT — for the top three, the smallest change that

   removes persistence or cross-run readability, and the

   legitimate workflow that change would break.

Ask me for anything missing before you answer. Do not assume.

Why it works: Table 3 is the load-bearing one. Anyone can produce a list of things that look risky; naming what each fix would break is what turns it into a decision somebody can actually take to a standup.

Where to be careful: the model can’t see your infrastructure, so it invents surfaces you don’t have and misses ones you do. Paste real config. And run it per agent — a fleet-level answer averages away the one with the wide credential.

Works best on: Claude Opus 5, GPT-5.6 Sol. Smaller models produce tidy tables with nothing in them.

🛠️  TOOL OF THE WEEK

‘It’s sudo in reverse — the agent starts with nothing and you hand back only what it needs.’

srt — Anthropic Sandbox Runtime  ★★★★☆  4 / 5

Where the Shared Surface Audit’s cut list becomes something enforced rather than agreed. OS-level, no container: Seatbelt on macOS, bubblewrap on Linux, a WFP filter on Windows. Free and open source.

—   Every outbound connection goes through local HTTP and SOCKS5 proxies enforcing a domain allowlist. An approved host returns HTML; anything else is refused.

—   Filesystem rules are OS-enforced, not advisory — reading ~/.ssh fails at the syscall, not at a policy the agent could talk its way past.

—   Wraps local MCP servers as well as coding agents, the half most people skip.

The missing star: it’s a research preview, the config format will move, and Linux wants bubblewrap, socat and ripgrep first. It also can’t help with the surfaces your agent is supposed to reach — an allowlisted bucket is still a bucket. Containment narrows the blast radius. It doesn’t answer the question the prompt asks.

github.com/anthropic-experimental/sandbox-runtime →

💡  TIP OF THE WEEK

Your first alert won’t come from security

It’ll come from the capacity graph. Nobody at OpenAI caught the message board with a detection rule — they caught it because the agents knocked Artifactory over on 4 July. An outage. And Hugging Face spotted its own breach before OpenAI had traced it back at all.

1. Route agent-infrastructure ops anomalies into the same triage queue as security alerts. Storage growth, request volume, cost spikes, wobbles in services nobody has deployed to in weeks.

2. Alert on object count per shared store per day, not bytes. A message board is thousands of tiny files and will never trip a size threshold.

3. Put the run ID in the write path. If you can’t tell which run produced an artefact, you can’t tell whether a later one read it.

The principle: a misbehaving agent is a load pattern before it’s an intrusion pattern, and load lands on a dashboard owned by people who don’t attend the security standup. This won’t help with low-volume agents that ask permission each step — you’ll watch those go wrong live. It’s for the unattended things on a schedule, which is most of them now.

Forward iPrompt →   Send this to whoever set up the shared bucket your agents write to.