Cleared to Act #28

What

Guest workloads rewrote host memory through an 18-year-old kernel networking flaw

Researchers at pwn.ai found the guest-to-host escape during Vercel's $1 million sandbox challenge: specially crafted IPv4 packets let a guest VM rewrite an already-validated packet header through deferred checksum handling, leaking host memory and ultimately running code as root on the host. The vulnerable code dates to Linux 2.6.27, so roughly 18 years of kernels carry it, and the fix only merged into mainline on October 14. Patching the guest changes nothing; only the host kernel under the sandbox fixes it. (pwn.ai write-up)

VS Code now hides agent harnesses that cannot enforce your policies

Released October 14, VS Code 1.142 routes any chat session under a managed permissions or sandbox policy through the Copilot Agent Host, the only harness that can enforce those rules. The Local harness options that cannot honor them (Claude, Codex, terminal chat) disappear while the policies apply, and Microsoft deprecated the old Windows Sandbox integration for terminal commands in Local sessions. Admins can opt out of the migration, but the editor warns that opting out also skips the runtime rules. (Visual Studio Magazine)

Supply-chain scanners now follow AI tools onto developer machines

JFrog announced October 21 that its supply-chain security platform now detects AI assets on developer machines: AI skills, plugins, and MCP servers get scanned where they run, alongside customer-keyed scanning and Agent Guard controls for agent workflows. The features ship to Unified Security and Ultimate Security customers, with BYOK scanning still in preview. It is the supply-chain boundary following the work to where agents actually live. (RuntimeWire)

Why

Each story checks the floor under a control instead of the control itself. PwnEscape shows the VM boundary lived in host networking code nobody had re-examined since 2008, not in the hypervisor where everyone assumed the floor was. VS Code treats a policy no running harness can enforce as decoration and routes policy-bound sessions to the one harness that can. JFrog redraws the supply-chain boundary to include the developer machines where agent tools actually execute, the one place the repo scanners never looked. The shared correction: audit where your control stands, not what it says.

How

Trace one agent control down to its actual floor by end of day. Pick your agent sandbox, your agent policy, or your repo scanner, and name the layer it rests on. Then verify that layer is what you assumed: the host kernel version under the sandbox, the harness actually enforcing the policy, the machines your scanner actually covers.