Sandboxing
is necessary but not sufficient for rogue agents
Cryptographer Matthew Green examines three competing views on
containing rogue AI agents. The infosec view says better infrastructure
suffices, but Green argues that useful agents require such broad access
(dynamic compute, network, subprocesses) that monitoring it demands
deploying other AI “wardens”, creating a nested alignment problem. The
most underappreciated risk: current agents are trivially vulnerable to
prompt injection, which could turn cooperative agents into vectors for
worms spreading across organisational boundaries, not through malicious
superintelligence but through adversarial humans manipulating compliant
systems. Cisco Talos’s “Closed Quorum” malware, running four LLMs with
no human operator, arrived the same day (see Norway).
Gemini
4 Argon: 1 million output tokens, leads SWE benchmarks
Google’s latest frontier model leads software engineering evaluation
(77.9% on DeepSWE v1.1) and enterprise automation benchmarks (51.3%
AutomationBench). The headline capability is an industry-first 1M output
token limit, an order of magnitude above previous 64K ceilings, enabling
sustained multi-step agentic trajectories in a single context window.
Google reports internal use migrating 800K+ lines to Rust and achieving
300 TiB memory savings. Priced at $2/$10 per million input/output
tokens.
ESXi
VM escape actively exploited since early 2024; Branch Target Reuse
brings Spectre-v2 to JIT engines
Huntress documents a full hypervisor compromise toolkit chaining
three VMware CVEs (CVSS 7.1–9.3): a memory leak in HGFS, a TOCTOU write
enabling code execution, and an ESXi kernel sandbox escape. The toolkit
supports 155 ESXi builds across versions 5.1–8.0 and installs a
persistent backdoor (VSOCKpuppet) communicating via VSOCK, invisible to
network monitoring. Build artefacts suggest working exploits existed a
full year before VMware’s March 2025 disclosure, meaning this likely
operated as a zero-day throughout 2024.
VUSec researchers separately document a new Spectre-v2 variant:
modern CPUs restore architectural coherence after JIT code modification
but do not invalidate stale indirect branch prediction entries. An
attacker trains the BTB to a freed address, allocates new code there,
and triggers speculative jumps into misaligned instructions, a
speculative execute-after-free. Working exploits are demonstrated on
Linux kernel cBPF (8 bytes/second), SpiderMonkey via WebAssembly, and
GraalVM. Intel, AMD, and ARM are affected; vendors have deployed
patches.
EDG C++ front-end
open-sourced after 40 years
Edison Design Group, whose C++ front-end has underpinned compilers
from Intel, ARM, NVIDIA, and Cray for decades and served as the de facto
reference implementation for C++ standard conformance, announced at the
November 2025 ISO meeting that it was winding down and releasing the
front-end as open source. The public repo covers the C and C++
front-ends along with supporting infrastructure, making the most
conformance-tested implementation in the industry available for study
and reuse.
Turbo
Haskell: a JIT compiler for Haskell on GraalVM
Turbo Haskell (THC) is a JIT compiler for Haskell built on GraalVM’s
Truffle framework. It takes over from GHC after the optimisation pass
and executes Core through its own JIT, supporting all GHC 9.14.1
primitives, Template Haskell, Linear Haskell, and SIMD. Its tail-call
optimisation avoids the trampoline overhead that plagued earlier
JVM-hosted functional languages, and polyglot FFI provides zero-copy
access to Python, R, Ruby, and JavaScript ecosystems. In the same vein,
wgsl-rs, a Rust-to-WGSL transpiler from the renderling project, hit
beta: write GPU shaders in Rust with its type system and transpile to
WGSL for WebGPU.
Halfspace:
an IDE for SDF solid modelling that exposes the distance field
Matt Keeter’s experimental IDE for SDF-based 3D solid modelling,
built on the Fidget geometry kernel. Rather than treating distance
fields as a hidden implementation detail, Halfspace exposes them with
topographic contour visualisation, making gradient discontinuities
visible directly in the editor, where they would otherwise silently
produce incorrect shading or mesh artefacts. Exports to triangle
meshes.
Cold
War ELINT satellites URSALA, RAQUEL, and FARRAH declassified
The Space Review documents three NRO signals intelligence satellite
programs, recently declassified. Deployed off HEXAGON
photo-reconnaissance buses between 1972 and 1992, these suitcase-sized
collectors intercepted Soviet radar emissions across 2–18 GHz. FARRAH,
the most capable generation, added onboard processors enabling
near-real-time signals delivery to battlefield commanders under the
TENCAP program, a then-classified shift from national-level intelligence
to direct tactical military support.