Containers share the host kernel, gVisor inserts a user-space kernel, and a microVM adds a guest kernel plus a hypervisor; all three still share the same host's CPU caches and storage.
Two programs with no connection can pass bits through the speed of a shared resource: one changes its state, the other times it. Such channels need an agreed protocol and are slow and easily drowned out; the local experiment is nearly error-free up to 20 bps and gets clearly worse from 100 bps.
No single defense blocks both covert channels and exits. Blocking channels comes down to not sharing, blocking exits comes down to narrowing the services you allow, and monitoring only notices while automatic stopping is a response after the fact; neither is prevention.
A sandbox with no direct network can still have an exit: any allowed service that can make requests on someone's behalf, such as a package proxy, a DNS resolver, or a metrics service, is one. OpenAI's three cases all have this shape.
OpenAI says its red-team agents built communication channels on shared hosts from cache, storage, CPU time, and a TLS certificate cache, and that most channels are slow; in most tests the channel or protocol was given, and bandwidth and error rates were not published.
A piece of agent code passes through five layers on its way from execution to a network connection: container, kernel boundary, shared host, network perimeter, monitoring. Each layer promises one thing, and the shared host layer promises almost nothing.
King and Worthington compared 134 paid expert pre-reviews of 124 manuscripts with Claude Opus 4.8 reviews: the GPT-5.5 judge chose the AI review in all 132 decided pairs, and three former journal editors chose it in 26 of 30 judgments. The result covers constructive pre-submission feedback, not journal refereeing.
Duet, Muse, Dots, Grok Bot, OpenClaw and Hermes can all work through your email and accounts in the background. They differ in who holds the computer, the credentials, the approvals and the data. Hosted agents save setup but leave model and data policy to the vendor; self-hosted ones let you swap models and read the source, but you have to turn the sandbox on yourself.
On October 20, Perplexity Computer gained a fully local mode: the model and the agent both run on an Apple silicon Mac, for Pro, Max and Enterprise subscribers, with 36GB or more memory recommended. Files and reasoning stay on the Mac, but live information, the browser and sending mail still go online.
Anthropic says Claude writes about 90% of Claude Code's code. This guide walks through their review flow: every PR passes seven layers, human approvals scale with risk from zero to two, and the goal is at most one human per change with no rise in reverts.
REA is an MIT-licensed MCP server that lets Claude Code, Codex, Cursor, and other agents read native binaries through Ghidra, Hopper, or IDA, and take apart Electron, .NET, APK, and web targets directly. What separates it from single-engine bridges like GhidraMCP is that every result carries an evidence ID, a coverage status, and its limitations. One npx rea-agents setup installs it, and JavaScript analysis needs no disassembler at all.
To cut the input tokens resent every turn, agent platforms often truncate, clear, or summarize old tool results, and skill instructions, write receipts, and error messages get cut along with them. The Complexity Trap shows observation masking can halve cost, yet Gemini 2.5 Flash with thinking still dropped from 40.4% to 36.4% solve rate. Measure savings against full history and fixes against the current setup, and judge by total cost per successful task, not shorter per-turn input.
Claude's docs say tool-selection accuracy degrades past 30–50 tools, and both Claude and OpenAI now load tools on demand via tool search. But finding a tool isn't finishing the task: on ToolRet's 43k-tool benchmark, no retriever put the complete required toolset in its top 10 more than 35% of the time. This post splits the problem into five failure points, maps seven approaches onto them, and lays out an evaluation.
Matt Pocock posted 18 'mistakes you might be making' on X with no explanations. Grouped against his public skills and talks, they fall into five: verification, letting go, context, alignment, thinking. Six map directly onto /retro's check categories, so you can try one session tonight.
A chat model is rewarded for a single response people prefer; an agent has to be rewarded for whether a multi-step task actually finished, which needs different data and environments.
Reasoning is the intermediate tokens between input and output; RL fine-tuning beats imitating human solutions because of a reliable verifier, and sampling several times then taking the most frequent answer pushes accuracy further.
AlphaGeometry2 relies on a symbolic engine and AlphaProof on Lean, for a combined 28 points in 2024; in 2025 Gemini Deep Think scored 35 points in natural language, with verification done by human graders.
Laskin's view is that engineers spend 80% of their time understanding systems rather than writing code, and that how far RL goes depends on clean rewards, a problem he considers as hard as superintelligence itself.
A VLA adds an action module to a vision-language model; letting that module's gradients flow back harms language understanding, so knowledge insulation blocks the gradient, while π0.5 co-trains on web data and data from many robots to gain generalization.
Alexandr Wang says Meta listed 100+ behaviors a personal agent needs, built an eval for each, and set two thresholds per row: a launch-blocking floor and a bar for 'good'. They shipped after the first all-green checkpoint and a hands-on check that it was clearly better; they also ran new-user testing. The method is reusable, but post-launch safety reports show all-green is not the same as safe.