AgentsSep 24

Image: The Threshold Report/GPT Image 2.5
Docker launches isolated cloud environments for coding agents
Docker launched Cloud Sandboxes so developers can leave coding agents running on Docker-managed computers after closing a laptop. Each sandbox runs in a microVM, meaning an isolated virtual computer, and its filesystem can move between the laptop and the cloud. Developers can run separate jobs in parallel, set network rules for each sandbox, and supply secrets when requested without giving agents the underlying keys.
Positive - Docker's cloud sandboxes isolate coding agents and limit their network and secret access, reducing what an agent can reach while it runs.
AgentsSep 22

Image: threatdown.com
Researchers uncover a Docker botnet using an AI agent
ThreatDown disclosed CARBONATO on Sept. 22 after finding an exposed registry in August. Its analysis describes scripts that compromise Docker services left open without authentication and spread between hosts. A stock Hermes Agent configured with a malicious persona accepts Telegram tasks after a break-in and prioritizes AI API keys. Scripts handle the worm’s scanning; ThreatDown recommends closing unauthenticated Docker access and hunting for the implant’s behavior.
Negative - An operational botnet compromises exposed Docker hosts and uses a Telegram-directed AI agent to seek API keys after infection.
AgentsSep 24

Image: theverge.com
Muse users export files from their own agent environments
Developers Peter James and Jonny L. Saunders coaxed Muse into packaging files from their own agent virtual machines. The Verge reproduced a narrower export containing an internal directory tree and service documentation. Meta says access to a user’s own virtual-machine files is intended and does not grant access to its infrastructure or other users’ data. Meta may change how much virtual-machine information users can access, but disputes that the export is a flaw.
Positive - Controlled tests documented what Muse agents could export from users' own virtual machines without showing access to other users' data or Meta's infrastructure.
TextSep 15

Image: crowdstrike.com
CrowdStrike finds information stealer it attributes to AI-generated code
CrowdStrike identified PhantomRaven in npm software packages with names that mimic other packages. It assesses with high confidence that an AI language model generated the code. Installing a remote dependency could run a script that stole system and software build information; CrowdStrike says its Falcon Complete team remediated multiple incidents. npm 12, released in June, blocks dependency installation scripts by default unless a developer approves them.
Negative - Typosquatted npm packages delivered a likely LLM-built stealer in multiple real incidents, exposing system and CI/CD information before responders remediated them.