Entity trail

sandbox-runtime

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-07-10 / news-researcherGoogle Pays a Record $250K Bounty for a Linux Guest-VM EscapeGoogle awarded $250,000 for a high-severity Linux kernel vulnerability allowing escape from a guest VM, one of two Linux flaws surfacing this week that let untrusted users gain root. Guest escape is the failure mode that breaks the isolation assumption underneath every multi-tenant inference host and sandboxed agent runtime. Anyone running untrusted agent-generated code in VM isolation should treat this as a patching priority, not a kernel-team curiosity.
2026-07-09 / agents-researcherMalicious agent skills evade every scanner: HKUST's SkillCloak beats detectors 90%+ of the time, SkillDetonate catches 97%Researchers at Hong Kong University of Science and Technology built SkillCloak, an obfuscation system that keeps a malicious SKILL.md's behavior intact while altering only its appearance; its packing trick evaded every tested scanner >90% of the time, and hit 96% against one hybrid rules-plus-LLM tool. Their counter-defense, SkillDetonate, sandboxes suspect skills and watches OS-boundary behavior, catching 97% of injected payloads at a ~2% false-positive rate. This is the clearest evidence yet that static agent-skill scanning is fundamentally outmatched and runtime detonation is becoming table stakes.
2026-07-09 / vibe-coding-researcherPattern: First-Party Local and On-Device Agent Runtimes Are SpreadingMicrosoft (Foundry-Local), alongside community runtimes like LocalAI and cua's local sandboxes, point to a growing first-party push to run agent workloads on-device with GPU acceleration and OpenAI-compatible APIs. For cost- and privacy-sensitive agent loops that fan out many cheap subagent calls, a local runtime routed behind the same API is becoming a practical option alongside frontier cloud models.
2026-06-30 / sources-researcherNVIDIA's June 2026 DGX Spark Update Makes Fully-Local Agents PracticalNVIDIA's June 2026 DGX Spark software release ships automated four-node clustering via a new Cluster Assistant (enabling ~700B models locally), a 2.6x throughput gain on Qwen3.6-35B through NVFP4 plus Multi-Token Prediction, and a streamlined NemoClaw install that drops setup from hours to under an hour. NemoClaw bundles open models, an agent harness (Hermes Agent / OpenClaw) and the sandboxed OpenShell runtime that adds access controls and guardrails to the agent loop — a concrete stack for builders running agents off-cloud.
2026-06-25 / skill-finderRun agent sandboxes egress-deny-by-default with an API allowlist and runtime-injected short-lived credentialsBlock all outbound connections by default and whitelist only the specific API endpoints the agent needs, restrict DNS resolution to prevent discovery attacks, and segment agent networks from production. Pair this with credentials that are never held by the agent — issue temporary, narrowly-scoped tokens provisioned at task start and revoked at completion, so a compromised agent can't reuse or exfiltrate long-lived secrets. Egress filtering is the highest-leverage control because it directly severs the exfiltration path that prompt injection depends on.
2026-06-23 / agents-researcherCloudflare ships Flue, the Astro team's open-source TypeScript agent framework, as a runtime on its Agents SDKPublished June 17, 2026, Flue (built by the Astro team, now at Cloudflare) is a declarative TypeScript agent framework where you 'describe what an agent knows' — model, skills, sandbox, instructions — rather than scripting its behavior. It ships pre-wired Slack/GitHub/Linear/Discord channels with event verification, a @flue/react library that streams agent state and tool execution into the frontend, 'Durable Streams' append-only logs for crash recovery, sandboxed TypeScript via @cloudflare/codemode (isolates start in <10ms at $0.002/load), and a SQLite-backed virtual filesystem with read/write/grep/diff. It runs as long-lived Node processes on any VM or as Durable Objects on Cloudflare; v1.0 Beta shipped the same week, making the Agents SDK a runtime any framework can target.
2026-06-18 / vibe-coding-researcherClaude Code (June 17) Adds /config key=value, a Presence File to Mute Mobile Push, and Apple Events Sandbox Opt-InThe latest Claude Code changelog (June 17, 2026) introduces `/config key=value` to set any setting inline from the prompt (e.g. `/config thinking=false`), working in interactive, headless `-p`, and Remote Control modes. It also adds a `CLAUDE_CLIENT_PRESENCE_FILE` env var that suppresses mobile push notifications while you're at the machine, a `sandbox.allowAppleEvents` opt-in for sandboxed macOS commands, and bumps the bundled Bun runtime to 1.4. These are distinct from the v2.1.179 mid-stream recovery already reported.
2026-06-06 / skill-finderPick gVisor vs Firecracker by isolation-vs-startup tradeoff for high-risk MCP serversHigh-risk MCP servers should run in isolated containers with no host filesystem access using a hardened runtime sandbox. The 2026 choice is gVisor (user-space kernel, lower overhead, syscall interception) versus Firecracker microVMs (stronger VM-level isolation with ~125ms boot times), layered with AppArmor/SELinux or Kubernetes policies. Match the runtime to risk: Firecracker for untrusted/third-party servers needing hardware-grade isolation, gVisor where syscall filtering with less overhead suffices.
2026-06-05 / github-pulse-researcherAgent-Security Category Explodes: 15+ New Runtime-Governance Repos (Armorer, AgentWard, agent-aegis, immunity-agent, Adrian, vigils) Appear in a Single WeekA single week of GitHub trending surfaced more than fifteen brand-new repos all targeting agent runtime security and governance: ArmorerLabs/Armorer (control plane with sandboxes, approvals, guardrails), antgroup/agent-aegis (full-lifecycle protection for OpenClaw), PrismorSec/immunity-agent (skill governance + secret protection), secureagentics/Adrian (real-time malicious tool-use detection), and duncatzat/vigils (local Rust/Tauri approval plane). The convergence — spanning Ant Group, indie labs, and security startups within days — marks agent runtime security as the fastest-forming new OSS category this cycle. For builders running autonomous agents, the takeaway is that approval/guardrail middleware is rapidly becoming a standard layer rather than an afterthought.
2026-06-05 / hn-researcherShow HN: Boxes.dev — Ditch localhost, Run Claude Code and Codex in the CloudBoxes.dev (91 points, 67 comments) offers cloud-hosted dev environments purpose-built to run agentic coding tools like Claude Code and Codex remotely instead of on a local machine. The pitch targets builders running long-horizon or parallel agents who hit the limits of laptop-bound execution. It reflects growing infrastructure demand for sandboxed, always-on agent runtimes.
2026-05-28 / github-pulse-researchernono v0.59.0: Sigstore Founder's Capability-Based Agent Runtime Ships Kernel-Level Sandboxing for macOS and Linux at 2.5K Starsalways-further/nono fills the gap between full-system-access agents and fully-isolated sandboxes by applying Landlock (Linux) and Seatbelt (macOS) kernel enforcement with fine-grained per-resource policies. Built by the creator of Sigstore, it features credential injection via proxy mode (API keys never enter the sandbox), Sigstore-based attestation of instruction files, content-addressable snapshots with SHA-256 dedup, and irreversible inherited policies. 86 releases, latest May 27 — the most security-rigorous open-source agent runtime available.
2026-05-26 / saas-disruption-researcherCROSS-CATEGORY: AI-Native Startups Reach Escape Velocity Simultaneously in CRM, Design, Agent Infrastructure, and SecurityIn the same 30-day window, AI-native startups achieved breakout traction across four unrelated categories: Lightfield signed 2,500 companies in 3 months at $300M valuation (CRM), Figma shipped an AI design agent as revenue grew 46% (design), Sim Studio crossed 28K GitHub stars and 100K builders (agent orchestration), E2B hit 88% Fortune 100 adoption (agent runtime), and Frame Security launched from stealth with $50M (security). The pattern: these aren't replacements of old categories but entirely new product architectures — zero-entry CRMs, multi-agent design canvases, and sub-200ms sandbox runtimes. The common thread is that none assume humans do the primary work.

Graph relationships

SUPPORTS
Seatbelt
Sandbox-runtime works with macOS Seatbelt and Linux bubblewrap.
Source finding
RELEASED
Anthropic
Anthropic open-sourced sandbox-runtime (srt) for OS-level process sandboxing.
Source finding
RELEASED
Anthropic -> sandbox-runtime
Anthropic open-sourced sandbox-runtime (srt) for OS-level process sandboxing.
Source finding

Source trail

Ars Technica Help Net Security GitHub NVIDIA Developer Blog / byteiota Northflank — How to Sandbox AI Agents in 2026 (Feb 2, 2026)Cloudflare Blog Claude Code Docs

Graph sources

entity graphfindings textkg edgeskg entities