buildConfirmed2 publishers Microsoft made Microsoft Execution Containers, its policy layer for limiting what AI agents can touch, generally available on Windows on October 7. It moves an agent's file and network permissions out of the prompt and into operating-system policy the agent cannot change.
Perspective Coverage
3 publishers
- Builder
- Builder 45%
- Operator
- Operator 28%
- Investor
- Investor 27%
Reality
- Evidence55
- Adoption35
- Hype gap+30
- Incentives65
- Confidence70
buildConfirmed2 publishers Meta's Muse agent wrote 6.8GB of its own Linux environment, SSH key files included, to Mouse founder Peter James's Google Drive, he says. James has not tested the keys, yet the export shows anything baked into an agent's image can leave through a storage connector the user linked.
Publishers:t.signalplus.com · tokenpost.com
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+25
- Incentives
- Not scored
- Confidence40
buildOne report1 publisher Bubblewrap hands the PDF binary one directory and no network by default
Escaping an uploaded filename keeps it from turning into a shell command, and it still leaves the parser reading everything the worker's account can read. A dev.to write-up draws the other boundary with Linux namespaces.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap−10
- Incentives55
- Confidence45
buildOne report1 publisher AI Employee runs secret and dependency checks in plain code before any model sees the diff
In this self-hosted pipeline, secret scans and a three-day minimum age on new npm packages run with no model call, and a branch reaches GitHub only after a human clicks approve in the dashboard. The author calls it a developer preview.
Reality
- Evidence42
- Adoption8
- Hype gap+18
- Incentives40
- Confidence46
Homebrew rated the unsigned cask removal metadata path High and closed it back in 6.0.12. The 7.0.0 upgrade adds one Moderate sandbox escape through LaunchServices, plus a scanner for installed formulae.
Reality
- Evidence68
- Adoption32
- Hype gap+12
- Incentives38
- Confidence74
buildOne report1 publisher solon-ai-sandbox puts an agent's bash call inside seatbelt or bwrap without a container
The Solon AI module ports Claude Code's sandbox-runtime to Java, denying writes by default and protecting reads only where the operator names a path. Keeping that deny list current is the standing cost.
Reality
- Evidence58
- Adoption12
- Hype gap+12
- Incentives60
- Confidence55
buildOne report1 publisher Homebrew stops shipping Intel bottles 353 days before its 2027 cutoff
Version 7.0.0 adds a brew vulns command that checks installed packages against OSV.dev and Homebrew's own advisory records. The same release drops Intel macOS 11 and later to Tier 3 and stops building bottles for it.
Reality
- Evidence58
- Adoption30
- Hype gap+10
- Incentives52
- Confidence66
buildOne report1 publisher Landlock confines a process from inside, with no root and no global policy
Landlock has been in mainline Linux since 5.13 and asks no administrator for permission. The dev.to walkthrough that demonstrates it prints a read-only rule under a goal that requires writing.
Reality
- Evidence32
- Adoption
- Not scored
- Hype gap+40
- Incentives20
- Confidence58
Anthropic trades 84% of Claude Code's permission prompts for a working-directory fence
Seatbelt on macOS and bubblewrap on Linux now stop the agent's shell at the folder it was invoked in and route its traffic through a domain allowlist. That is a boundary a security team can approve once.
Reality
- Evidence34
- Adoption22
- Hype gap+20
- Incentives66
- Confidence42