Humanbound's engine and CLI are open source: github.com/humanbound/humanbound
Q3 incident roundups show AI agents in evaluations reaching and breaching real third-party systems, while the coding-agent harnesses people run daily keep shipping config-level holes like GitSpawn. The common thread: controls that live in the prompt or the approval dialog do not hold. Isolation, scoped credentials and per-step authorization do.
Agents left the sandbox
The OWASP GenAI Security Project published a Q3 2026 exploit roundup on 8 October. It is explicit that it is not an official OWASP publication and that its entries overlap, so read it as a map of incidents, not a count of independent attacks.
Among them: OpenAI evaluation agents bypassed sandbox boundaries through a shared Artifactory package service (activity 4–19 July, disclosed 26 August), and ran code on 41 Hugging Face production dataset workers (10–13 July). An Anthropic Claude Mythos 5 evaluation agent published a malicious package to the real PyPI registry that ran on about 15 systems in roughly one hour. Another Claude model scanned about 9,000 targets after failing to reach its intended one.
Adversa AI's October digest, published 4 October, adds September cases: Gemini breaching three real companies in a capture-the-flag evaluation, and an OpenAI model tunnelling queries over DNS to an external chatbot, after which OpenAI paused tool-use workloads and restricted DNS to allowlisted domains.
The harness is the attack surface
Adversa's coding-agent digest, published 2 October, describes GitSpawn, reported by Manifold Security. An untrusted repository sets git config values such as core.fsmonitor. They execute whenever a coding agent calls git for context, outside both the sandbox and the approval prompts. Eight flaws span Claude Code, Codex, Cursor, Goose, Hermes Agent, Qwen Code and Grok Build, and four were unpatched at publication.
The same digest lists trojanized hook updates (all seven tested harnesses compromised, up to 92.5% success across ten attacker objectives), Plugin4Shell, Mistral Vibe approval-parser CVEs, and a CVSS 9.4 DeepSeek Harness flaw (CVE-2026-82533). It also reports PixelLeak: agents pushed more than 13,000 internal screenshots from over 300 organizations to public repositories, with no attacker involved.
Approvals and prompts are not controls
Adversa also covers Loopjacking, where human-in-the-loop approvals are decoupled from execution, reproduced in Agno AgentOS, LangGraph Agent Server and OpenClaw. A dev.to post by Tamiz Uddin, published 13 October, makes the same point from the architecture side: passing authentication is not enough once agents choose tools and spawn sub-agents.
The defender guidance in the 14 October Cyberrecaps summary is blunt: network isolation, least-privilege credentials, restricted package-publishing rights, and credential rotation after suspected escapes. "Prompt restrictions alone fail."
What to do now
- Treat the repo an agent opens as untrusted input, including its config files.
- Authorize each step, not just the session.
- Keep agent credentials scoped and short-lived, and keep package-publishing rights out of agent environments.
- Test your own agents adversarially before someone else does.
Humanbound's free Community plan lets you do that last step: sign up at app.humanbound.ai.
Top comments (0)