Published CVEs are becoming agent sandbox escape routes

SemiAnalysis reports that agents can turn published vulnerability descriptions into working exploits against software beneath an agent sandbox. That makes the host part of the containment boundary: a patched sandbox on an unpatched machine can still expose an escape route. Teams running agents against untrusted code should treat host patch cadence and reachable system software as security controls, not routine maintenance. Read: SemiAnalysis reports that public CVE descriptions can give an agent enough detail to build a working exploit, so unpatched host software remains part of the sandbox security boundary. Read: LLaDA-Image uses diffusion for both image understanding and generation, and its Turbo variant performs instruction-guided edits in two to four sampling steps. Read: Artificial Analysis places Muse Image near Nano Banana 2 and GPT Image 2 on its editing board, with access through Meta, fal, Runway and OpenRouter. Read: The new ant apply command reconciles agents, skills, memory stores, environments and deployments from versioned repository configuration instead of console state. Read: Nous Research now profiles a Windows or Linux machine, chooses a compatible model and configures its runtime, removing the manual hardware and quantization matching step. Read: Krea's new image API moves house style into structured conditioning through reference images, whole moodboards and a creativity control, with two size tiers for cost and photorealism.