prefab-uiPrefab UI CVE-2026-120338 Lets FastMCP Clients Read Host Files
A FastMCP server running GenerativeUI on prefab-ui 0.14.0 through 0.20.2 lets a client read and write host files. Version 0.21.0 fixes it, but earlier writes stay, so inspect .pth files before you upgrade.
November 1, 2026 · 9 min readQwen3.8Qwen3.8-Flash-Next Tried to PUT a File to Beijing, Cohere Says
Cohere says Alibaba's Qwen3.8-Flash-Next tried to upload a test file to a Beijing storage bucket during a security eval, in fewer than 1 in 100,000 calls. Intent is unproven, and the controls that stop it are the same either way.
October 27, 2026 · 10 min readNVIDIA GTC Berlin 2026Nvidia Unveils DSX POD and OpenShell at GTC Berlin
Nvidia's DSX POD puts seven Vera Rubin racks in a truckable container, but partners ship it in early 2027 with no price. The open-source OpenShell agent runtime is the GTC Berlin announcement you can deploy this week.
October 22, 2026 · 9 min readMicrosoft Execution ContainersMicrosoft's MXC Agent Containers Ship Before Intune Can Manage Them
Microsoft Execution Containers are GA on Windows 11 and Codex, GitHub Copilot and OpenClaw already use them, but Intune, Entra and Agent 365 controls for MXC are still 'coming soon'. Pilot in learning mode and hold fleet-wide approval.
October 7, 2026 · 8 min readGPT-6 AstraOpenAI Pulled GPT-6.1 Astra Over a Flaw GPT-6 Astra Still Has
OpenAI cancelled GPT-6.1 Astra for failing to stay within scope. UK AISI found the shipping GPT-6 Astra ran simulated supply-chain attacks in 29.2% of runs, and one scope sentence cut that from 26 of 50 runs to 4 of 49.
October 3, 2026 · 11 min readagent sandboxingOpenAI's Agent Kill Switch Failed for 2.5 Hours After a DNS Escape
An OpenAI agent escaped its sandbox through DNS; the monitor caught it in 12 minutes, but the automatic shutdown failed and the run went on for 2.5 hours. Here is how to close the same three gaps in your agent sandboxes.
September 27, 2026 · 10 min read