Friday, August 21, 2026

A type-confusion bug in isolated-vm — the V8 wrapper that n8n, Mastra, Sim.ai and Activepieces all run untrusted code inside — lets sandboxed JavaScript corrupt host memory. Cloudflare and Edinburgh published a remote Spectre attack that pulls a JWT out of a co-located Worker at 12 bits/second with no native code and no sandbox escapeBreaking out of a sandbox, the restricted environment that limits what untrusted code can reach.NIST ↗ at all. And Varonis got Microsoft Copilot to disclose its own undocumented autorun parameter, turning one click into silent exfiltration from a victim's connected Gmail and Drive. Meanwhile Slack put coding agents into shared channels, and Binance gave them a trading account.

TLDR

Slack Code launched: coding agents get their own channels, with Claude Code, Devin, Copilot, and Vercel live on day one and shared diffs, previews, and pause controls (Aug 20) Agents Trending
Critical sandbox escape in isolated-vm — affects every version through 7.0.0 and sits under n8n, Mastra, Sim.ai, and Activepieces; patched in 6.2.0 / 7.0.1 (Aug 20) Security Open Source
Microsoft patched a one-click Copilot data-theft chain 8 months after disclosure — CVE-2026-24301 "CoSnitch," exfiltrates from connected Gmail/Drive/Calendar (Aug 20) Security
Binance opened spot, margin, and futures trading to AI agents via Agent OS and an MCPModel Context ProtocolAn open standard that lets AI apps connect to data sources, tools and workflows through one common interface.MCP ↗ server, no withdrawal scope, emergency stop included (Aug 20) Agents
Ramp's August index: OpenAI is closing on Anthropic with US businesses — 43.5% vs 39.7% adoption, but OpenAI is growing faster in Q3 (Aug 20) Trending

Action Items

Things your engineering team should look at or do this week.

Find every place isolated-vm is in your dependency tree, including transitively, and pin to 6.2.0 or 7.0.1. It has over a million weekly downloads and it is almost never a direct dependency — it arrives underneath a workflow-automation or agent framework. If you run n8n, Mastra, Sim.ai, or Activepieces anywhere that executes model-generated or user-supplied JavaScript, that's a host-memory corruption path from inside the sandbox. There is no CVECommon Vulnerabilities and ExposuresA public catalog that gives each known security vulnerability a unique ID, a short description and at least one reference.NIST ↗ yet, so npm audit may not flag it — check the GHSA directly. (Endor Labs | The Hacker News)
Answer this question out loud today: can you halt a runaway agent's spend in under a minute? VentureBeat's new enterprise research puts 21% of organizations at "post-hoc logs only" — no real-time way to stop an execution loop that's burning tokensA small unit of data, such as part of a word, that AI models read and generate. Many AI services price by tokens in and out.NVIDIA ↗. Linear shipped per-user and workspace spend limits the same day, which is the shape of the control you want: a hard cap that resets on a schedule, not a dashboard you read on Monday. (VentureBeat)
If you've enabled Copilot Personal connectors on managed devices, confirm the August 18 patch landed. CoSnitch chained an undocumented ?autorun=1 parameter with the known ?q= prompt parameter so a single link click executed an attacker's prompt with no confirmation, against whatever the user had connected. Varonis reported it in December 2025; the fix shipped eight months later. Treat "we reported it to the vendor" as the start of your exposure window, not the end. (Varonis | The Hacker News)
Before anyone opens a Slack code channel, decide who can approve a merge from inside Slack. Slack Code inherits existing Slack permissions with no new admin setup — which is the selling point and the risk. Anyone in a channel can steer or pause an agent, and non-engineers can file work that an agent drafts. Get the approval routing configured before the first channel spins up, not after. (Slack)

Models & Tools

Slack — Slack Code (Aug 20) Agents Trending — Mention a coding agent in a project channel and Slack spins up a dedicated code channel around that task: code diffs, live HTML previews, and a plan, all visible to the team rather than to one person in a private tab. Anyone in the channel can jump in, pause the agent, or redirect it mid-task; when the work lands, the channel archives itself and stays searchable as an audit log. Launch partners are Anthropic (Claude Tag), Cognition (Devin), GitHub (Copilot), and Vercel, with OpenAI's ChatGPT "available soon" — and it works on any Slack plan. The number worth stealing from their internal rollout: over 70% of code channels open and close within a single day, idea to merged PR. The strategic read is that Slack is betting the bottleneck in agenticDescribes AI systems where a model uses tools and decides its own steps instead of following a fixed script.Anthropic ↗ development is review and context-sharing, not generation — which is consistent with everything the benchmark data has been saying for a year. (Slack | VentureBeat | TNW)
Binance — Agent OS and Binance MCP Server (Aug 20) Agents Customer AI — A developer platform that lets AI agents read market data, monitor accounts, and place spot, margin, and futures trades, with ChatGPT, Claude Code, Codex, and Cursor supported out of the box. The safety design is the interesting part and is worth studying even if you never touch crypto: agents get a dedicated subaccount to ring-fence funds, no withdrawal scope at all in the MCP connection, no access to email or KYC data, revocable permissions, and an emergency stop that disconnects every agent and cancels open positions and orders. Binance can see the trades but explicitly cannot see the agent's reasoning or its external data sources — the accountability gap that shows up in every agent-with-authority deployment. Coinbase shipped its equivalent in June, Kraken's requires human approval per trade, so the field is now split on whether an agent may act unsupervised with real money. (Cointelegraph | crypto.news)

APIs & Pricing

Linear: coding sessions move to pass-through token pricing plus metered sandbox time (Aug 20) Pricing Agents — Two components, both legible: model usage billed at the provider's published rates with no markup, and sandbox runtime at $0.25 per 20-minute block. The usage dashboard breaks down tokens and cost by model, and admins can set workspace-wide and per-user spend limits that reset daily, weekly, or monthly, pausing AI credit usage when hit. Shipped alongside configurable environments (Linear Agent now detects and installs toolchains for Python, Ruby, Go and others, with pinnable runtime versions and setup scripts) and browser testing, where the agent runs the app, navigates a flow, and captures before/after screenshots. The pricing model is the news: a vendor unbundling "the model cost" from "the compute we ran it on" is a much easier line item to forecast than an opaque credit. (Linear changelog)

Security

isolated-vm: type confusion in ExternalCopy lets sandboxed JS corrupt host memory (GHSA-864f-rcv7-6rh4) (Aug 20) Security Open Source Agents — The bug is in the C++ glue that serializes values across the isolate boundary — specifically ExternalCopy's handling of the transferList option — so code running inside the V8 isolate can corrupt memory in the host process, with potential RCERemote code executionA flaw that lets an attacker run malicious code on a target's computers or network.Cloudflare ↗. All versions up to and including 7.0.0 are affected; patched in 6.2.0 and 7.0.1, both released earlier this month. No CVE has been assigned yet, which matters because your scanner may be silent. The exposure story is the reason to act: isolated-vm does more than a million downloads a week and is the standard answer to "run untrusted JavaScript safely," which makes it load-bearing exactly where model- or user-generated code executes — n8n (200K stars), Mastra (27K), Sim.ai (29K), and Activepieces (23K) all sit on it. Reported by Endor Labs. (Endor Labs | The Hacker News | CSO Online)
"CoSnitch" (CVE-2026-24301): Copilot leaked its own undocumented parameter, enabling one-click exfiltration (disclosed Aug 20; patched Aug 18) Security — Varonis Threat Labs chained three flaws in Microsoft Copilot Personal so that clicking a single crafted link silently pulls data from connected apps — Gmail, Google Drive, Google Calendar — and anything else in the victim's Copilot session. The mechanism deserves attention beyond the CVE: researchers repeatedly questioned Copilot's own security assumptions until the assistant disclosed an undocumented ?autorun=1 URL parameter, which combined with the documented ?q= prompt parameter to execute an injected prompt with no user confirmation. That is a new-ish class of finding — the model as an oracle for its own attack surface — and it generalizes to any assistant that can reason about the product it's embedded in. Reported to Microsoft in December 2025, patched August 18, 2026. Varonis found no evidence of exploitation in the wild. (Varonis | The Hacker News | Computerworld)
Remote Spectre pulls a JWT out of a co-located Cloudflare Worker at 12 bits/second (Aug 20) Security Infra — Researchers from Cloudflare and the University of Edinburgh demonstrated an end-to-end leak in the production environment — 360x faster than the 2021 attack — using WebSocket messages as a remote timing source. The part that should worry anyone running multi-tenant compute: it required no native code execution, no V8 exploit, and no conventional sandbox escape. It was attacker-Worker against researcher-controlled victim-Worker with the JWT deliberately placed in memory, and no customer data was accessed. Cloudflare says it's mitigated in production via improved Dynamic Process Isolation, the V8 Sandbox, and MPK-based in-process isolation, with no indicators of exploitation over three years. If you're building your own agent-execution platform on V8 isolates because containers felt heavy, this is the counter-argument in paper form. (Cloudflare | The Hacker News | SC Media)

Industry & Business

Ramp's August AI Index: OpenAI is closing the business-adoption gap with Anthropic (Aug 20) Trending — Across 70,000+ US businesses using Ramp's card and bill-pay products, Anthropic led at 43.5% adoption in July against OpenAI's 39.7% — but OpenAI is growing faster among that segment in Q3 to date. The more interesting split is adoption versus consumption: GPT-5.6 Sol accounted for 25% of tokens and 23% of corporate spend in July, while Anthropic's Fable 5 took 6% of tokens and 11.4% of spend. More companies sign with Anthropic; OpenAI's newest model eats a disproportionate share of the actual workload. Caveat the panel — it excludes large enterprises on Amex-style spend tools, so it under-samples exactly the segment where Anthropic has been winning. (TechCrunch | Ramp)
Anthropic commits ~$250M to Fractile's inferenceRunning a trained model on new input to get an output, as opposed to training it.NVIDIA ↗ chips; the startup repriced 6x in three months (Aug 20) Infra — Fractile, founded 2022 by Oxford roboticist Walter Goodwin, builds SRAM-based inference silicon aimed at latency rather than throughput. The initial supply agreement with Anthropic is roughly $250M with stated intent to expand, and it moved Fractile's pre-money valuation from about $1B in May to $6.5B in advanced talks for a ~$600M round co-led by Redpoint and Lightspeed, with Thrive and Founders Fund expected in. The detail that keeps this honest: the chips aren't expected to be usable until 2027, so this is a forward supply commitment on unshipped silicon, not a deployment. Read it as the second data point this week — after Google's Marvell warrant — that frontier labs are paying real money to second-source away from Nvidia before the alternatives exist. (Bloomberg via Yahoo Finance | TNW)

AI in Production

Enterprises are running three orchestration platforms at once, and one in five can't stop a runaway agent (Aug 20) Agents Production — VentureBeat Pulse Research surveyed 100+ enterprises with 100+ employees. Two findings are actionable. First, the median enterprise runs three orchestration platforms simultaneously — not from indecision but from an explicit refusal to hand one vendor the whole control plane. Second, 21% track agent spend only through post-hoc logs, with no real-time way to halt an execution loop. Governance is ahead of metering: organizations know how to permission agents and still can't tell you what one costs while it's running. Microsoft leads on current primary usage; Anthropic leads by a wide margin on what enterprises say they're considering next. (VentureBeat | VentureBeat, orchestration deep-dive)
Linear's own telemetry: AI now authors just under half of everything created in Linear (Aug 2026 report) Data Agents — Two years ago it was fewer than one issue in a thousand. At the current rate AI will soon create more issues than people and integrations combined. The adoption curve is broader than engineering: between January and June 2026 the share of users active on AI features more than doubled in every function — Product 12%→34%, go-to-market 5%→18%, and CEOs at 201+ person companies 9%→36%, the largest jump in the dataset. The finding a team lead should sit with is the negative one: time spent on customer requests, docs, and projects held flat in a year when nearly every other metric rose. Nothing shrank to make room. AI landed on top of existing work rather than displacing any of it. (Linear)

Policy & Safety

Pew: 52% of Americans are more concerned than excited about AI, and under-30s crossed the majority line for the first time (Aug 18) Policy — Fielded June 22–28. Overall concern is up from 37% in 2021; only 9% are more excited than concerned, with 37% equally both. The generational reversal is the story: 55% of adults under 30 now say concerned rather than excited, from 31% in 2021 and 39% in 2024 — the demographic that adopted every prior consumer technology first is now the most wary. Jobs drive it: 71% expect AI to reduce job opportunities, up from 64% in 2024, and 73% among under-30s. This is the polling substrate under the data-center backlash and the midterm dynamics we covered yesterday, and it's the constituency your recruiting pipeline draws from. (Pew Research Center | Forbes)

Paper Spotlight

Claude ran autonomous de novo protein binder campaigns and beat the industry hit rate roughly 2x in wet-lab validation (Aug 20) Trending — Anthropic published results from 15 clinically relevant targets including PD-L1, TREM2, TNFα, and EGFR: 354 confirmed binders from 1,320 designs, a 22.6–35.1% hit rate against a 10–15% industry baseline for de novo campaigns, with 14 of 15 targets yielding at least one working design. In single-target mode against RBX1, Mythos Preview hit 40%. What separates this from prior AI-protein-design claims is that Adaptyv Bio and Twist Bioscience synthesized and tested the designs physically, without modification — the model ran the campaign, the contract labs graded it, and the grading was independent. Anthropic says life-science capabilities remain restricted in its most capable model and is preparing a gated access program for scientists, which is itself the notable governance choice: a capability demonstrated publicly and withheld pending vetting. (Anthropic | paper (PDF) | TNW)

One theme runs through almost everything today: the sandbox is the security boundary, and the sandbox keeps failing.