Article URL: https://calif.io/research/big-fish Comments URL: https://news.ycombinator.com/item?id=50118977 Points: 31 # Comments: 2
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
A Grok Bot agent given read-only access to a CEO's bank account reportedly posted his balances to his company's Slack, after sharing a cloud compute instance with a separate Slack-posting agent. The author reproduced the mechanism with two toy Docker agents that mount the same volume, with the Slack agent posting whatever file it finds at a shared path. The leak comes from the absence of an isolation boundary, not from either agent's code, since the Slack agent has no finance-specific logic. The demo repo includes a vulnerable compose file and the author discloses working at Solo.io, which created kagent.
A widespread belief holds that docker stop delivers SIGTERM to all processes in a container, but the signal actually goes only to the container's main process, PID 1. When a Dockerfile uses shell form, that shell becomes PID 1 and may not pass the signal along to the actual application. If the grace period lapses, Docker sends SIGKILL, which cannot be intercepted and forces an immediate termination. Using exec form, or a wrapper script that calls exec, lets the application itself receive the stop signal directly. Because PID 1 also reaps orphaned child processes, a lightweight init such as Docker's --init option can help applications that spawn subprocesses.
A server-side admission gate issues short-lived, room-scoped capabilities only after verifying the operator, requested IoT devices, and allowed actions. Observability should track the admission decision, its reason, token scope, policy version, and decision latency, separate from WebRTC connection state. Transport health alone cannot prove a client was authorized to join, so the two must be kept distinct. Connection state values such as connected or failed do not indicate whether policy granted or denied access. Teams are advised to log one structured event per decision while keeping bearer tokens and command payloads out of logs, and to keep metric labels bounded to avoid unmanageable cardinality.
A developer has built an autonomous coding agent designed to tackle challenging programming tasks in competitive settings. Instead of producing code in a single LLM pass, the system follows a full workflow of repository analysis, planning, implementation, execution, testing, and refinement. Its key feature is an iterative feedback loop in which failed tests are diagnosed, the code is updated, and the relevant tests are rerun before submission. The author plans to compare performance with and without this loop using success rate, tests passed, completion time, and compute cost, though the article presents these metrics only as placeholders. Further optimizations include model selection, prompt design, tool usage, and failure recovery.
Discussion (0)
Log in to join the discussion and vote.
Log in