A single page can RCE your agent's host

A single web page can take over the machine running your AI agent. Microsoft’s security team published a writeup of AutoJack, an attack where a browsing agent that loads a malicious page gets walked into remote code execution on its host. The framing matters more than any single CVE: the agent is the delivery vehicle, and the blast radius is whatever its process can touch. It landed the same day a cluster of agent-security work surfaced, which is the real signal. Google DeepMind put out “Securing the future of AI agents”, Cloudflare shipped temporary accounts so an agent can sign up and deploy without slamming into a human OAuth wall, and Grab’s engineering team described Palana, an internal platform built to give autonomous agents scoped, auditable access. Read together, these say the field has moved from “agents are useful” to “agents are a new identity and a new attack surface, and nobody has the controls yet.”

The compute side of that buildout is tighter than the public numbers suggest. Anjney Midha, who runs the compute-pooling operator AMP, put his own pipeline on the record: 1.3 gigawatts secured against roughly 6 GW needed over four years, a 4.7 GW gap that translates to years of constrained supply for independent labs. One detail stands out: anticipated 2026 year-end excess capacity vanished in six weeks. If your mental model still treats the shortage as a 2024 hangover that’s clearing, this is the argument that it’s structural.

On the tooling side, Anthropic shipped artifacts in Claude Code, bringing the generated-app preview surface from the chat product into the coding agent. Pricing moved the other way for OpenAI users. A widely-upvoted GitHub issue reports the effective rate-limit cost per token on Codex with GPT-5.5 jumped 10x or more on the Plus plan since June 16. Whether that’s a deliberate repricing or a metering bug, it lands just as developers get better instruments to see these costs: GitHub’s Copilot usage-metrics API now reports AI credits consumed per user per day, the kind of line item finance teams start asking about once agent fleets run continuously.

The business case for that spend got a loud data point. Replit went from $2.5M to $250M in revenue in twelve months, a 100x jump that Amjad Masad says passed a PwC audit and is gross-margin positive, with the company now aiming at a billion this year. Two years ago the same company was doing around $3M. Gross-margin positive is the unusual part in a category where most revenue is subsidized by token burn.

Underneath the money, the open question is still whether the code is any good, and a lot of practitioners spent the day arguing about review. “When I reject AI code even if it works” hit the Hacker News front page at 82 points and 41 comments with a simple thesis: passing tests isn’t the bar, and a reviewer who can’t reconstruct why a change is shaped the way it is should send it back. CodeRabbit made the same point from the vendor side, that the bottleneck in review was never reading the diff but recovering intent. Both react to the same pressure: agents now generate more plausible code than any team can carefully read.

The answer to that pressure is automation that keeps a human at the gate. A well-received Show-and-tell, beflow, moves the whole task loop onto an issue board: drop a card in Todo, the tool runs Claude in an isolated git worktree, opens a PR, moves the card to In Review, and applies a CODEOWNERS-style policy file that blocks sensitive paths and parks ambiguous tasks in a Needs-Input column instead of guessing. It’s v0.2.0 and solo-built, but the shape is where multi-agent workflows are converging: the board is the control panel, the agent never touches the tracker, and PR ownership stays with the orchestrator rather than the model.

For the layer below all of this, the Pragmatic Engineer’s deepdive on “inference engineering” is the explainer worth your time right now: the discipline of squeezing latency, throughput, and cost out of model serving, now its own job title rather than a sub-bullet under ML ops.

What to watch: whether any lab or major framework ships actual agent-sandboxing defaults in response to AutoJack, or whether host RCE stays a known and unfixed risk the way prompt injection has.