Posts of last few hours

AWS released Strands Box, an open source sandbox for AI agents that pairs operating-system isolation with rules that can weigh what an agent has already done before letting it act again. Box is in developer preview and runs on Macs with Apple silicon, with Linux support planned. If you run coding assistants, you’re familiar with the problem Strands Box targets. Agents read files, run shell commands, execute code they wrote and call APIs, and many … More →

The post Strands Box: Open-source sandbox for AI agents appeared first on Help Net Security.

Researchers at Northwestern University tested AI coding agents on 112 real security bugs. They found that a patch which stops a crash often fails the checks the project’s maintainers wrote for the fix. With Claude Opus 4.7, third of the patches that made the crash go away still failed those maintainer tests. If you’re thinking about letting an AI tool patch vulnerabilities for you, this is the number to look at. Many security patching benchmarks … More →

The post AI vulnerability patching has a grading problem appeared first on Help Net Security.

Many organizations adopt open source software because they see it as a cheaper alternative to proprietary development. Maintaining it, however, still requires engineering effort, according to Google’s case study, “How much does it cost to maintain a copy of an open source software package (at Google)?” Study suggests that most updates to its internal copies of open source packages should take four engineering hours or less. More demanding updates can require days or months of … More →

The post What makes some open source updates so difficult? appeared first on Help Net Security.