The Brief

New briefs daily around 7 AM Eastern

Published CVEs are becoming agent sandbox escape routes

SemiAnalysis reports that agents can turn published vulnerability descriptions into working exploits against software beneath an agent sandbox. That makes the host part of the containment boundary: a patched sandbox on an unpatched machine can still expose an escape route. Teams running agents against untrusted code should treat host patch cadence and reachable system software as security controls, not routine maintenance.

• 01Read

  Published CVEs become agent sandbox escape routes

  SemiAnalysis reports that public CVE descriptions can give an agent enough detail to build a working exploit, so unpatched host software remains part of the sandbox security boundary.

  SemiAnalysis_→
• 02Read

  Ant open-sources a fully diffusion-based image stack

  LLaDA-Image uses diffusion for both image understanding and generation, and its Turbo variant performs instruction-guided edits in two to four sampling steps.

  ant_oss→
• 03Read

  Meta Muse Image reaches fourth in independent testing

  Artificial Analysis places Muse Image near Nano Banana 2 and GPT Image 2 on its editing board, with access through Meta, fal, Runway and OpenRouter.

  ArtificialAnlys→
• 04Read

  Claude adds declarative apply to its ant CLI

  The new ant apply command reconciles agents, skills, memory stores, environments and deployments from versioned repository configuration instead of console state.

  ClaudeDevs→
• 05Read

  Hermes Desktop automates local model setup

  Nous Research now profiles a Windows or Linux machine, chooses a compatible model and configures its runtime, removing the manual hardware and quantization matching step.

  NousResearch→
• 06Read

  Krea 2 API accepts style references and moodboards

  Krea's new image API moves house style into structured conditioning through reference images, whole moodboards and a creativity control, with two size tiers for cost and photorealism.

  Krea editorial sitemap→