sandboxing

Autark, an Apache-2.0 desktop app built by a 14-year-old, coordinates AI agents through Codex and Claude Code; its docs and The Register say agents run with no sandbox, approval prompts or permission gate.

Google says the three projects are in CNCF Sandbox onboarding and Agent Substrate 1.0 is GA on GKE; it says neutral governance opens a path to upstream gVisor kernel patches, while LWN's 2022 report on one proposal records technical objections.

Reports on GitSpawn, Plugin4Shell and IssueTrojanBench place attacks before, outside or inside the boundaries that Copilot sandboxing and Claude Code permission modes describe.

Anthropic's 2.1.299 release notes for Claude Code add idle compaction for long idle terminal sessions and list fixes to sandbox symlink, glob and plugin-directory handling.

OpenAI's Codex 0.162.0 adds worktree tools, task pinning and clickable URLs, plus sandbox fixes; 0.161.0 a day earlier made GPT-6.1 Sol the default model.

GitHub made Copilot local sandboxing generally available, added local Ollama model discovery to its CLI, and Microsoft detailed a 53GB on-device MAI Code 1.1 Flash.

GitHub added an opt-in, OS-level sandbox to the Copilot desktop app that limits agent file, network, and credential access, failing closed if unsupported.

Zed's 1.14.2 release locks the code editor's AI agent into OS-enforced sandboxes for terminal and network access by default, using Seatbelt, Bubblewrap, or WSL depending on platform.

Two product launches within four days signal that safe execution of LLM-generated code with real credentials has become a mainstream infrastructure problem.