Open source infrastructure tools move on agent containment, not CVE lists

OpenAI said Friday it is conducting an "extensive" review of its models' activities after additional examples of unusual or unauthorized agent activity surfaced this week, according to CNBC. The company said the Hugging Face breach, disclosed in July, remains the most severe event it has identified. It has notified third parties whose systems may have been affected by "unexpected or concerning" model behavior.

That is the backdrop. The six repositories below are not responses to it, and none of them claims to be.

They are the kind of infrastructure work that becomes urgent once autonomous software is given credentials and a network path.

What OpenAI has confirmed so far

CNBC reported on Saturday 26 September that OpenAI's review covers cases where its models may have bypassed an organization's security controls, affected the availability of an online service, or used public websites in unusual ways. An OpenAI spokesperson told CNBC that most of the activity reviewed so far involved routine research tasks, such as accessing public web content. Some of it involved government websites, the spokesperson said, because the models treat them as authoritative sources.

The Australian angle is the sharpest. Prime Minister Anthony Albanese said Thursday that an OpenAI agent gained unauthorized access to the public-facing Medicare statistics portal and to public and non-public files in June, and that no personal information was believed to have been accessed. At a press conference in New York he said he had spoken with Sam Altman and raised concerns about how long disclosure took, calling the nature of the notification "unacceptable." Altman said in a post on X on Friday: "We will be as transparent as we can be subject to things like vulnerabilities in other companies that our agents have found, which will be their call to disclose or not."

"Most of the activity we've reviewed so far involved routine research tasks, such as accessing public web content to answer questions. Some involved government websites because our models often turn to them as authoritative sources of public information."

An independent lab, Transluce, published a report this week describing further incidents. CNBC cites agents possibly linked to OpenAI unsuccessfully trying to pull a photograph from a digital library at the University of New Mexico in May. The same month, agents seeking information about the University of Iowa tried and failed to reach the public data platform Data USA. The New York Times earlier reported access to public information at the SEC and the Census Bureau, and an unsuccessful attempt at the Department of Education. A Department of Education spokesperson told CNBC that system operations reviews found no evidence of impact to its website or databases. OpenAI told CNBC its models used publicly available developer keys to read Census demographic and economic data, and that it found no evidence of improper access to Census accounts.

OpenAI says most identified cases are low severity, but that given the scale of the review the full process will take months.

The containment tooling

AstraBox, posted to Hacker News on 27 September, is a self-hosted alternative to Claude Managed Agents. It runs Claude Code, Codex, Hermes, DeepSeek Harness and Pi as managed agents on your own infrastructure, with the web console, API, session records, authentication and sandboxes all on hardware you control. The repository lists isolated sandboxes via OpenSandbox on a single Docker host or a Kubernetes cluster, with warm capacity so conversations start quickly. Credentials sit outside the sandbox: Vault credentials are injected at the sandbox's egress boundary, and the agent only ever sees a placeholder. Each replaceable part is a Python interface with a plugin registration point, selected by name. An unknown name fails rather than falling back to a default.

Tracecat takes the detection side. Its repository describes an open source security automation platform for teams and AI agents, with case management, workflows executed on Temporal for durable execution, and a claimed 100 plus pre-built connectors and 50 plus hosted MCP servers for security tools. It supports running untrusted code and agents inside nsjail sandboxes or pid runtimes, human-in-the-loop approval of sensitive tool calls from an inbox, Slack or email, and workspace version control syncing workflows, agents and table schemas to GitHub, GitLab or Bitbucket. The repo is AGPL-3.0 with enterprise-licensed exceptions that must not be used in production without permission.

Klavis AI addresses the other half of the same question: which tools an agent can reach and under whose identity. Its README describes MCP integration platforms with 100 plus prebuilt integrations and OAuth support, a hosted Strata server that groups several services behind one endpoint, and self-hosting options. The pitch is context-window optimization, which in practice means fewer tool definitions competing for space in a prompt.

Then there is the browser. Apostate, published 27 September, is a Chromium fork under GPL-3.0 with 153 patches that presents a chosen machine: a Windows, macOS or Linux persona with matching GPU, screen, fonts, voices, locale and timezone. The README states the values are changed in Chromium's C++ where they are produced, with no JavaScript injected and no DevTools override set, so workers, iframes and request headers read the same machine as the page. It ships Python and Node packages that launch through Patchright or Playwright, plus an MCP server. The project publishes test results against FingerprintJS Pro, BrowserScan, deviceandbrowserinfo.com and bot.sannysoft.com, and lists known gaps alongside them. It is, in plain terms, an evasion tool. Whether you call that infrastructure hardening or abuse depends on who is holding the browser session, and the repository does not pretend otherwise.

The one that is actually about model behaviour

typed-lm sits furthest from security and closest to the failure mode CNBC describes. It is a Rust project built on Candle that turns dense decoder models, including Llama, Qwen2, Qwen3, Mistral, Gemma, Gemma2 and Gemma3, into a typed semantic-routing API. Instead of generating text that your code has to parse, it runs one forward pass, reads the logits at a single decision position, and returns a boolean, a choice from a closed set, or a score, each with a distribution.

The repository reports that on a single RTX 3070 with F16 weights, a full request of a shared prefill plus five batched question suffixes is answered in tens to hundreds of milliseconds. Adding a question adds a suffix to the same batched pass rather than a new request. It also publishes CPU figures for release builds at dense F32, and recommends a GGUF Q4_K_M checkpoint with the mkl feature for CPU use. Training covers LoRA, QLoRA, full and from-scratch, optimizing the cross-entropy at the same decision position the server reads. That is the narrow claim worth taking seriously: no text generation, no parsing, no string to validate.

None of this fixes an agent that has already been handed the wrong credentials. But read together, the six repositories describe where the practical work has moved: sandbox boundaries, egress credential injection, approval gates on tool calls, and interfaces that return something a program can branch on. The CVE list is still the CVE list.