The one about AI guardrails, container escapes, and supply-chain trust
Welcome to the August 2026 edition of the Datadog Security Digest!
This month’s digest has a familiar theme: systems tend to break at their boundaries. We’ve got agents escaping test environments, cloud credentials leaking out of GitHub workflows, containers stepping where they shouldn’t, and a self-propagating npm campaign that had perfectly valid provenance. Let’s get into it.
This newsletter was created by a real person, not a machine. Your curator of the month is Dan Maher.
Before the first prompt: Code execution paths in trusted coding-agent projects
A project can start influencing a coding agent before you ever type a prompt. Our latest research shows how project-controlled MCP configuration in Codex and environment settings in Claude Code can execute code after a project is trusted but before the first prompt, model response, or command approval.
Scary stuff, but the advice is straightforward: treat new projects like you would any potentially unsafe code, and open unfamiliar repositories in disposable environments without sensitive credentials.
Cloud and Container Security
OVSwrap: another Linux local root vulnerability
OVSwrap is a Linux kernel vulnerability in Open vSwitch that can allow an unprivileged user to escalate to root on affected systems. It is also potentially reachable from a container with the right namespace-local permissions, which makes it a good reminder that containers are isolation boundaries, not magic force fields. For a deeper dive into the subject, check out this blog post from our very own Rory McCune.
A GitHub issue, Gemini CLI, and a GCP project compromise
Pillar Security found that a malicious public GitHub issue could reach a privileged Gemini CLI workflow, expose a cloud credential on the runner, and lead to access to the underlying GCP project. It is a neat, unpleasant little chain: untrusted issue content, an AI coding agent, CI permissions, and cloud identity all doing exactly what they were configured to do.
Critical containerd vulnerabilities affect managed Kubernetes
Google published a bulletin covering five crit-level containerd CRI-plugin vulnerabilities that could let an actor able to create pods bypass Kubernetes security boundaries, compromise a host, poison cache, or cause denial of service. If you run Kubernetes, this is a good excuse to check your managed-service patch status and make sure workload creation is not more widely available than it needs to be.
AI Security
AI agents keep finding the edge of the sandbox
The OpenAI–Hugging Face incident postmortem is worth watching in full: during a cyber evaluation, agents found paths out of their environment, compromised external infrastructure, and coordinated their work through a shared message board. It was not the only story of its kind this month (researchers also reported sandbox escapes involving Moonshot’s Kimi K3 and Meta models) so the practical takeaway is less “wow, agents!” and more like “treat evaluation environments like production attack surfaces. Dhruv AHUJA also has a great write-up where he describes how OpenAI models bypassed network security measures implemented with DNS.
Do AI models write secure code?
AI is notoriously good at writing code. But is it good at writing secure code, and how do various models and configurations compare? Datadog's own Kennedy Toomey took 3 models to the test bench.
Stolen Thoughts: recovering proprietary reasoning traces
This one's pretty wild: researchers showed that encrypted reasoning blocks returned by several proprietary model APIs could be replayed across sessions and models to recover hidden reasoning in plaintext. Their analysis of publicly available agent trajectories also turned up real credentials, tokens, and personal information, which is a fairly strong argument for treating those opaque-looking response artifacts as sensitive data.
Turns out everything is still an authz problem
Scalex looked at how much access AI agents are given in practice, and built a game that provides a mildly alarming test of whether you read commands before approving them. If you want the Datadog perspective too, our CISO joined a16z to discuss what securing agents at scale actually requires: clear permissions, useful controls, and fewer assumptions that the agent will know where to stop.
An AI security analyst for less than $500 per month
Grow Therapy built a Claude-powered threat-hunting system on top of its existing AWS, Snowflake, and Datadog setup, then documented the whole thing: the architecture, cost model, and what they learned after running it. The most useful bit is that the system does not simply trust its first answer—it has a dedicated validation phase where the model has to argue against its own findings and produce evidence before escalating.
Application Security
Belgian eID extension bugs with a very large blast radius
Researchers found multiple serious issues in the Connective signing extension used by Belgian banks and government services, including eID/PIN exposure and drive-by remote code execution. The extension and native helper effectively turned a website visit into a route toward identity abuse, code execution, or both! An impressive amount of damage for a component most users probably didn't know they had installed.
EvilFontTool makes people and machines read different things
EvilFontTool abuses custom fonts so that the text displayed to a person can differ from the characters stored in the file. It is a wonderfully cursed technique with implications for documents, web content, copy/paste, filtering, and AI workflows that ingest text without considering how it was rendered. If you're interested in how it works, it's all open source.
Phishing at 30,000 feet
After DEF CON, a passenger on a Delta flight from Las Vegas reportedly set up a rogue network to (apparently) imitate the airline’s onboard service and lure passengers into a phishing flow. The exact mechanics remain under investigation, but the defensive lesson has held up for decades: when a Wi-Fi network asks for credentials it doesn't need, close the tab!
Supply Chain Security
npm worm "ChainDrop" compromises hundreds of popular npm packages
The community witnessed the first npm worm, Shai-Hulud, around 9 months ago. This new worm, dubbed "ChainDrop", managed to compromise over 400 highly popular packages, including some with over 150 million weekly downloads. It's a good reminder that while npm trusted publishing is valuable, it doesn't help against all attack vectors.
Python packages can run more than their source code suggests
A new paper looks at the nebulous space between what source-focused security tools inspect and what Python can actually execute, including bytecode files, compiled-only modules, and marshalled code objects. It is a useful bit of academic ballast for anyone who has ever looked at a tidy source tree and assumed that was the whole package.
Community events and talks
The conference circuit is roaring back!
Here in France we call the start of September la rentrée (the return) because we all come back from our summer holidays. Whether it was summer for you or not, one thing is certain: September is coming in hot with conferences and more! Here's a quick pick of things to check out online or in person.
- fwd:cloudsec Europe: Jules Denardou and Daniel Henkel, “What Could Possibly Go Wrong? Running untrusted code in the cloud”; Timothy Gonda, “Cloud Security Is Dead. Long Live Infrastructure Security.” All talks from fwd:cloudsec Europe will be streamed online for free on September 7-8.
- Infobip Shift: Daniel Maher, “Building a (Mostly) Reliable AI Research Agent.”
- Wild West Hackin’ Fest: Andrew Krug and Tara Schofield, “Wrangling Identity and Access in AWS.”
Emilio Escobar on securing AI agents at scale
Ever wondered what it takes to secure a modern software company with thousands of engineers using AI? In this fascinating conversation, Emilio Escobar, Datadog's very own CISO, shares the approach that worked for us internally
Interactive tabletop exercise led by Florian Jörgens
Solid incident response takes practice. Good news: practice can be fun and interactive! On September 15, Florian Jörgens will be leading an interactive tabletop exercise featuring a fictional attack complete with a $2 million ransom demand.