Open until something selects it
Kubernetes' agent sandbox ships a secure default that lets an untrusted agent reach every address on the public internet and forbids it from resolving the name of the service beside it. The posture is defensible. What holds it is one NetworkPolicy object, and every route to stronger isolation requires replacing or deleting that object.
An agent sandbox's containment is not a property of the sandbox but one additive NetworkPolicy keyed to a hash of its template's name, so every route to stronger isolation requires replacing or deleting the object that provides it.
Somebody else resolved it
A patch release to a distributed inference framework now refuses to fetch a caller's image when an HTTP proxy stands in the way, because the proxy resolves the destination where the server cannot check it. Turning the fetch back on means vouching, in an environment variable, for a control you do not own.
Multimodal serving made the inference tier an HTTP client dialling caller-supplied addresses from inside the cluster, and because every protection depends on the server resolving the name itself, an ordinary egress proxy reduces the control to an operator's environment variable vouching for somebody else's check.
The clock did not scale
Automated vulnerability discovery has arrived at industrial volume, and the ninety-day disclosure deadline has been dropped to let it in. The instrument that used to put a date on someone else's fix is gone, and nothing outside your own organisation will ever date one again.
Model-generated vulnerability reports cannot carry a disclosure deadline, because nobody verified them — so the only mechanism that ever converted a finding into a scheduled fix has been retired exactly as the volume of findings made it indispensable.
Only the reload was wrong
Seven of the fixes in LangGraph 1.2.13 land in the same room: the code that rebuilds a thread's state out of its own past. One of them explains the whole class of bug in six words, and they are the six words an architect should find least comfortable.
LangGraph reconstructs a thread's state by walking a history that operators can edit and runs can fork, so an agent's state is a query rather than a record — and because live execution stays correct, every failure of that query arrives only after a resume.
The mission has no field
The IETF's workload identity group has adopted a framework that makes an AI agent's identity unforgeable and its credentials short-lived. The step that decides what the agent asks for is one sentence long, and it says the step is somebody else's problem.
Agent identity is standardised to cryptographic rigour while the step that turns a natural-language mission into the scopes an agent requests is out of scope, so least privilege is computed at run time by the component the same document forbids from holding a credential.
Opaque, supplied by the caller
vLLM can now rewrite the weights of a running engine while requests are in flight, and its documentation says plainly that a paused request resumes under the new ones. The only version those weights carry on the serving path is a free string with a default value of "default".
vLLM has made a live model's weights mutable mid-request while leaving their only serving-path identity an optional string the trainer types, so the one instrument that could say what actually answered is a dev-mode endpoint you must stop serving to call.
Ask the node
Kubernetes has just made the containers in a running pod mutable, so that agents can spawn tool sandboxes in milliseconds. The record of which containers a node actually agreed to run was judged too expensive to store, and now lives on the node, ten statuses deep.
Kubernetes has moved the record of what a pod is actually running out of cluster state and onto the node, where nothing can watch it, list it, or keep it past ten containers.
Callable is not legible
In one proposal, MCP deprecated the three features by which a tool declared what it could touch, whose model it used, and what it was doing. Every replacement the specification names sits on the far side of the boundary the protocol exists to cross.
MCP has deprecated the three features that made a tool call legible rather than merely executable, and every replacement it names sits on the server's side of the boundary, leaving the host it still holds accountable unable to say what a tool did.
Cancelled is not undone
The Agent2Agent protocol was built on a declared virtue — that a remote agent need never reveal its internal state, memory or tools. That was affordable when delegation meant asking for a value. A2A is a protocol for delegating actions, and its record has no place to put them.
A2A tells a caller that a delegated task stopped producing output, never that it stopped having effects, so the protocol cannot say whether there is anything to compensate.
All or nothing, once
Kubernetes has promoted gang scheduling to beta and given distributed training the all-or-nothing guarantee it has wanted for a decade. The guarantee covers the moment of placement. The workloads need it to cover the fortnight afterwards, and nothing in core owns that interval.
Gang scheduling standardises all-or-nothing placement under a name that reads as all-or-nothing existence, so the property distributed training actually depends on — every pod alive at once, for the duration — still has no object, no reversible status and no accountable owner in Kubernetes.
The rule ships with the key
On 3 September the Apache Iceberg REST specification gained read restrictions — row filters and column masks that a catalog returns to whatever is loading a table, in the same JSON object as the credential to that table's files. Every obligation in it is written as something the reader must do.
Iceberg returns row filters and column masks in the same response as the storage credential, so lakehouse access control is now a property of the reader that the catalog can neither negotiate beforehand nor record afterwards.
Nothing in the bytes says skill
The Model Context Protocol's Skills extension went Final this month, letting a server ship a folder of instructions into an agent's host. The same bytes are inert documentation or an active instruction set depending only on which path fetched them — and every rule that keeps the two apart is a rule for somebody else to implement.
The Skills extension makes activation rather than content the unit of trust, so the safety of server-shipped instructions rests on a distinction that exists only in the host's bookkeeping, and no shipping client has finished writing that bookkeeping yet.