Docker Cloud Sandboxes: Start an Agent on Your Laptop, Finish in the Cloud
On September 24, Docker introduced Cloud Sandboxes: microVM environments on Docker-managed infrastructure for long-horizon agent work that runs for hours rather than minutes. Each sandbox has its own kernel and Docker daemon and uses the same isolation model as local Docker Sandboxes. That means the same CLI works in both places and the same guarantees hold for files, network, and secrets.
The key workflow is sbx move my-project --to cloud. It snapshots a local sandbox's filesystem and recreates it in the cloud, or the other way round. A developer can start a task locally, hand it off before closing the laptop, and pull it back later. Ready-made kits cover Claude Code, Codex, Copilot, Antigravity, OpenCode, and Hermes (sbx --cloud run claude). MCP tools are connected once through a shared gateway. Secrets are stored centrally and injected per request through a proxy, so they are never placed inside the agent's context.
Pricing is per second, from $0.07/hour for 1 vCPU and 2 GiB up to $1.12/hour for 16 vCPUs and 32 GiB. Sessions default to one hour, with a maximum of 24. Local sandboxes remain free, and the feature requires sbx 0.45.1 or later. Moving from "the agent runs in my terminal" to "the agent runs in a disposable VM I can relocate" is becoming the standard setup for unattended agent work.
Read more — Docker Blog
UK AISI and EvalEval Push a Shared Schema for Reproducible Benchmark Results
A September 22 Hugging Face post describes joint work by the UK AI Security Institute and the EvalEval coalition on a long-standing problem: evaluation results are reported in many formats and places, often without enough detail to reproduce them. Two pieces of infrastructure came out of it. The Every Eval Ever (EEE) schema is a standard format for recording how an evaluation was run and what it produced. Evaluation Cards combine benchmark metadata, run data, and model metadata into readable records.
AISI seeded the platform with verified results for six frontier models on five benchmarks: HealthBench, FrontierMath, Humanity's Last Exam, SWE-Bench Pro, and Terminal-Bench 2.0. It also published a companion paper, How Inference Compute Shapes Frontier LLM Evaluation, which shows how setup choices such as reasoning budget can move reported scores.
For teams that choose models based on published numbers, the takeaway is to treat benchmark claims without run metadata with suspicion. This week's model launches all rely on vendor-reported, effort-dependent comparisons. Benchmark authors can contribute through the EEE schema on GitHub, and model developers can publish verified results as Evaluation Cards.
Read more — Hugging Face
Safe & Secure AI Agent Practices
Docker and CNCF Partner on an Open Spec for Agent Permissions
Docker announced the Sandbox Kit Spec at WeAreDevelopers on September 24 and brought it to the CNCF for neutral governance. The spec is Apache 2.0 licensed. A Kit packages three things into a single standard OCI image: the agent (for example Claude Code or Codex), the tools it can use, and a typed permission scope. The scope lists the network hosts the agent may reach, the credentials it may use, and the volumes it may mount.
Because a Kit is an ordinary OCI image built on existing extension points, not a new artifact type, existing registries, scanners, and signing tools already handle it. Permissions are part of the image, so the agent and its allowed actions are versioned, signed, and pinned together. A widened permission appears as a diff in review. Docker Sandboxes is the first runtime that enforces Kits, and Docker says it should not be the only one. Launch partners include AWS, Palo Alto Networks, Snyk, Datadog, Dynatrace, JFrog, and OpenClaw.
The spec answers a question most agent deployments handle informally today: what exactly is this agent allowed to do, and where is that written down? A declarative, least-privilege manifest that travels with the artifact gives security teams something to review and gives runtimes something to enforce.
Read more — Docker Blog
SkillSecurer Finds Latent Prompt-Injection Flaws in 17% of Popular Agent Skills
A paper submitted to arXiv on September 12 by researchers including Marco Mellia introduces SkillSecurer. It is a two-agent framework for auditing the skill packages that coding agents load. A "red" agent generates injections that fit each skill's context across nine threat categories. A "blue" agent analyses the package, points to evidence, and proposes patches. For controlled tests, a verifier checks the blue agent's findings against the injections that were actually planted.
Applied to popular skills from the skills.sh directory, the tool found latent prompt-injection vulnerabilities in more than 17% of them, and some triggered real incidents during testing. With the best backend model, SkillSecurer reached a 100% injection-detection rate on the controlled set and outperformed existing skill scanners.
The practical point is that skills are code-adjacent content that an agent reads with high trust, and they are distributed through marketplaces with little review. Teams that let agents auto-load third-party skills should treat them like dependencies: pin versions, review changes, and scan before use.
Read more — arXiv
A2ABreak: Formal Analysis Finds 11 Spec-Level Vulnerabilities in the A2A Protocol
A2ABreak, submitted on September 9 by Alireza Lotfi, Mirza Masfiqur Rahman, Imtiaz Karim, and Elisa Bertino, applies formal modelling to the Agent-to-Agent (A2A) protocol, which is now at v1.0 and supported by more than 150 organisations. The authors derived a unified model of 37 states and 76 transitions from the specification. They identified 11 vulnerabilities that an adversary can exploit while fully complying with the spec, so these are not implementation bugs.
The findings fall into three classes. Context injection works through identifiers that are not protected across clients. Credential harvesting becomes possible when identity is lost along a delegation chain. Rogue agents with unverified capability claims can exfiltrate data. The method reached 73.3% precision and 84.6% F1 against independent expert review. A zero-shot LLM baseline given the same specification found nothing confirmed, which supports the authors' argument that protocol security analysis needs formal grounding.
For teams building multi-agent systems on A2A, the takeaway is not to rely on capability claims or on identity carried through delegation hops. Verify agent identity at every boundary and scope credentials to a single hop.
Read more — arXiv
METR's Pre-Deployment Evaluation of Claude Opus 5.5
METR published its pre-deployment assessment of Claude Opus 5.5 on September 22. It is based on 10 business days of API access, five tasks, a review of Anthropic's questionnaire responses, and an interview with an Anthropic researcher. The tasks included a budget-constrained NanoGPT speedrun, a model-training replication task, a game-playing bot, and an open-ended research-and-report task.
METR concludes that Opus 5.5 is a modest step over Fable 5.1, not a large jump. In METR's assessment, it will noticeably accelerate researchers and automate limited parts of AI R&D, but it is unlikely to automate AI R&D fully. METR notes weaknesses in foresight and research judgement. The report cites a preliminary internal estimate of about 1.5x overall capability acceleration from AI during the model's development, with perhaps a 30% chance of 2x.
METR is explicit about its limits: little visibility into Anthropic's internal development, difficulty separating sources of acceleration, and reliance on redacted findings from another METR team. The report is a useful reference point for the third-party-evaluator arrangements now being discussed across the industry.
Read more — METR
Links & Sources
- Introducing Cloud Sandboxes: Start on Your Laptop, Finish in the Cloud
- How UK AISI and EvalEval Are Making Benchmark Results Reproducible
- Docker and CNCF partner on an open spec for agent permissions
- SkillSecurer: Detecting and Patching Prompt-Injection Vulnerabilities in AI Agent Skills
- A2ABreak: Systematic Security Analysis of the A2A Protocol
- Summary of METR's predeployment evaluation of Claude Opus 5.5
You May Also Enjoy
