Microsoft made agent sandboxing generally available, then footnoted the fleet-management part
Microsoft Execution Containers became generally available on Windows 11 on 7 October. MXC lets an organisation define which files and networks an agent may access and enforces those policies at runtime, which is the right shape for agents whose containment needs change with every prompt and tool call. MXC works across operating systems, though Microsoft ties the wider range of containment options — process and session isolation, WSLc, virtual machines, Windows 365 for Agents — to Windows specifically. Codex, GitHub Copilot, OpenClaw, Replit, LM Studio, NVIDIA's OpenShell and Unsloth AI support it today; Claude Code, Box, Egnyte, Heidi Health, Manus, Perplexity, Raycast, Simular and Nous Research's Hermes Agent are listed as coming.
Two things are worth reading closely before treating this as solved. Microsoft's pitch is that containment plus agent identity plus manageability lets organisations govern agents at scale, and the sentence that names Agent 365 and Intune as the manageability layer carries footnote 1: "Governance at scale may require additional services." The containment primitive is in the operating system; what it costs to govern across a fleet is deferred to a footnote. Second, the piece that decides whether a task stays on the device or goes to a cloud model is not generally available. GitHub's HydraFusion has routed tasks among cloud models since earlier this year; the extension that lets it reach models running locally arrives in experimental preview later this month, in the GitHub Copilot app, the Copilot CLI and Visual Studio Code. For a European buyer the order matters. The control that keeps an agent inside a boundary shipped; the control that decides whether a prompt crosses one is a preview, and it lives in a developer-tools router rather than in the device-management console. The Register has the Copilot side, including the demo where Copilot found and organised a user's tax documents and drafted an email with them attached.
AWS open-sourced the better agent policy model, as a preview that runs only on an Apple-silicon Mac
AWS released Strands Box on 7 October under Apache 2.0, and the design is a real step past sandboxing. Containers and microVMs decide what an agent can reach and then stop thinking; Box keeps evaluating. The host OS enforces the direct access restrictions declared in `box.toml`, while four components — Strands Shell, Monty for Python, the egress gateway and the MCP broker — send the operations they handle to an embedded policy engine that evaluates rules in `policy.dw`. The policy language, Dogwood, uses `permit` and `forbid`, denies checked operations unless a rule permits them, and shares one event history across all four, so a rule can turn on elapsed time and on what the agent already did: a file read through Shell or Python can make the gateway deny a later outbound HTTP request. The gateway also authenticates permitted requests with configured credentials or AWS SigV4 signing itself, so the agent does not receive the underlying secrets, and policy decisions are recorded in OTLP JSON. AWS VP and distinguished engineer Marc Brooker told The Register that Box enforces developer-configured policies deterministically and "the agent can't talk its way around these rules."
Then the README's own label: "Preview: Box currently supports local execution on macOS with Apple silicon." Its walkthrough asks for a Mac with Apple silicon on macOS 15 or later, Node.js 22.21 or later, and access to Claude Opus 5 on Amazon Bedrock in `us-west-2` — so the quickstart for an Apache-2.0 sandbox runs through a paid US-hosted model endpoint. The first tagged release, v0.1.0, was cut on 7 October. The Register adds that Linux support is in development and a Windows client is "on our radar," with no planned release date for either, and that deployment to AgentCore, ECS and Kubernetes is also planned. So the week produced two agent-containment launches pointing opposite ways. Microsoft shipped generally available on the fleet enterprises actually manage and left the cost of governing it in a footnote. AWS published a policy model you can read, fork and audit — credential injection and decision records included — as a preview, on the one platform none of your agents are running in production. Anyone evaluating agent containment for a regulated workload this quarter is choosing between a governance story with a footnote and a governance design with no Linux build.
Singapore's new AI guidelines put third-party AI on the buyer, and the review bar waits until 2028
MAS published its Guidelines on Artificial Intelligence Risk Management for Financial Institutions on 7 October, following a consultation it ran in November 2025. They apply to all financial institutions and all forms of AI, and the expectation that should interest anyone selling inference into the sector concerns third parties. An FI remains accountable for AI used in the services it delivers, including AI developed, operated or provided by someone else. It should obtain sufficient assurance from that provider, should assess whether the third-party AI is suitable for its intended use, and should apply compensating controls where practical constraints or assurance gaps arise. If the risks cannot be brought within the firm's risk appetite, MAS says it should consider limiting, suspending or replacing the use of the service. Deputy Managing Director Ho Hern Shin framed the exercise as clarity rather than constraint: with it, "FIs can innovate with confidence."
The timeline and the scope both need care, because the coverage has compressed them. The guidelines take effect on 7 October 2027, and firms may phase them: the expectations in Sections 3 to 4 from that date, Sections 5 and 6 by 7 October 2028. Pre-deployment review sits in Section 5, which makes it a 2028 date, not a 2027 one. Nor is independent review required for everything. Paragraph 5.18 asks for review by parties not involved in development, with the scope and the independence of that review proportionate to assessed risk materiality. Paragraph 5.19 reserves formal independent validation — by competent people independent of both the development and the deployment teams, covering conceptual soundness of the design, suitability and quality of data inputs, integrity of the implementation, evaluation measures and results, explainability and fairness, and assumptions, limitations and mitigants — for use cases assessed as having high risk materiality. Below that line, paragraph 5.20 allows other forms of documented review, such as peer review by qualified individuals not involved in development or deployment. MAS also says existing governance structures may be used where they provide adequate oversight and cross-functional coordination, that no dedicated AI committee is needed solely to meet that expectation, and that it intends to consult the sector during 2027 on what additional guidance on agentic AI would be useful.
Quick Hits
- Google's new embedding model puts text, images, audio and video in one space under Apache 2.0. EmbeddingGemma 2 is about 740M parameters in total, of which roughly 270M is the text core and the rest the vision and audio encoders; SiliconANGLE reports a quantised text core using about 191MB when Google tested it on a Pixel 11 Pro, and a score of 78.68 on the code section of MTEB, almost ten points above the first EmbeddingGemma. Multilingual text scores barely moved.
- Microsoft's own agent framework could be talked into launching anything, by way of Explorer. CVE-2026-105791, published 6 October, says the `run_shell` tool in Microsoft UFO validated only the first token of its `bash_command` parameter and permitted `explorer.exe` — and because Explorer hands its following path argument to ShellExecute, an attacker-influenced agent call could launch an arbitrary executable or script as the desktop user even though the subprocess ran with `shell=False`. Fixed in 3.0.9. The 7.5 "high" rating is GitHub's, not NVD's, and its vector requires user interaction.
- Two WordPress plugins that sell themselves on AI agents shipped deserialisation and authorisation holes. CVE-2026-82627, rated 7.5, is PHP object injection in Uncanny Automator up to and including 7.6.1.1, exploitable by an authenticated user with Subscriber-level access or above. CVE-2026-105196, published 8 October, says the Appointment Booking plugin before 5.6.9 skipped per-record authorisation on several AI Abilities API actions, letting a restricted agent role read and modify other agents' profile data and read their bookings and customer details.
- A desktop project now makes contributors declare that no model wrote their patch. COSMIC's pull-request template has contributors acknowledge "I have not included any LLM (also known as AI) generated content in this PR, including code, comments, and descriptions," and says PRs without the completed checkbox will be closed. GNOME developer Michael Catanzaro argues for the opposite reflex about a different artefact — reports, not patches. AI-generated issue reports are "essential and unavoidable," he wrote on 2 October on his own blog, the overwhelming majority of vulnerability reports are now AI-generated, and "projects that continue to prohibit AI-generated vulnerability reports are no longer suitable dependencies for GNOME."