Good morning. Here is what matters in AI today, and how to put it to work.
Agent infrastructure is maturing fast: Docker, DigitalOcean, and new research are all converging on making AI agents auditable, permissioned, and production-safe.
~5 min read · last 12 hours
In today's issue
01
Docker brings AI agent permission packaging to CNCF as Sandbox Kit Spec
02
DigitalOcean Managed Agents brings hosted cloud infrastructure to AI agents
03
Praxa: a research harness that separates proposal, authority, and verified effect for LLM agents
04
Causal world models help LLM agents navigate modular service dependencies
05
Patched ChatGPT Mac app flaw could have exposed sensitive user data to attackers
Main story
Docker brings AI agent permission packaging to CNCF as Sandbox Kit Spec
Docker is donating its Sandbox Kit Specification to the CNCF, turning agent permissions into OCI images so that what an AI agent can and cannot do becomes a portable, auditable artifact.
Why it matters: This is the kind of supply-chain primitive that makes agent deployments auditable at the infrastructure layer rather than just the application layer, and it deserves a place in your container security review now.
What to watch next: Watch whether other container and cloud vendors follow Docker's lead into CNCF, since broad adoption of the Sandbox Kit Spec as a standard would make agent permissions as portable and auditable as container images are today.
We are watching a clear cluster form around the hard engineering work of running agents safely in production: Docker is standardizing what agents are allowed to do, DigitalOcean is abstracting away the cloud plumbing, and researchers are building formal governance harnesses and causal reasoning into agent architectures.
Build Your Own Open-Source Dots with Pi and Telegram
Hugging Face
One-shot generative flows: Existence and obstructions
Microsoft Research
The Signal
The day's items collectively signal that the AI industry is moving past "can we build agents" and into "can we govern, secure, and operate them reliably." Docker's CNCF contribution and DigitalOcean's managed offering show infrastructure vendors racing to own the agent runtime layer. At the same time, a patched ChatGPT app vulnerability and a troubled hospital AI rollout are sharp reminders that software quality and change management have not caught up with deployment ambition. For engineering and product leaders, the practical question is no longer whether to run agents in production, but whether your permission model, audit trail, and rollout process are ready for the scrutiny that is coming.
All the best, the KYFEX team
Quick hits
Agents in production: permissions, governance, and infrastructure
DigitalOcean Managed Agents brings hosted cloud infrastructure to AI agents
DigitalOcean launched Managed Agents in public preview, offering a managed cloud environment purpose-built for running AI agents without operators having to wire up compute, networking, and storage themselves.
Why it matters: For teams that want to ship agent workflows without owning the infrastructure stack, this is a meaningful reduction in operational overhead, though vendor lock-in trade-offs are worth evaluating early.
Praxa: a research harness that separates proposal, authority, and verified effect for LLM agents
Praxa is a new agent execution framework that treats proposal, authorization, dispatch, and verified external effect as distinct, separately logged claims, making governed agent execution formally tractable.
Why it matters: Any team building agents that write to external systems should study this separation of concerns: it maps cleanly onto compliance and audit requirements that regulators are already asking about.
Causal world models help LLM agents navigate modular service dependencies
New research shows that when LLM agents operate across modular systems like order, payment, and inventory services, embedding a causal world model improves their ability to reason about valid action sequences across modules.
Why it matters: Teams building agents that span multiple microservices should treat causal dependency modelling as a first-class design concern, not an afterthought.
Platform and security signals developers cannot ignore
OpenAI DevDay 2026 dropped a dense set of developer updates while, in the same week, a patched Mac app vulnerability reminded us that AI software is itself an attack surface, and a high-profile hospital scheduling failure showed what happens when AI deployments skip the human-factors work.
Patched ChatGPT Mac app flaw could have exposed sensitive user data to attackers
A now-patched vulnerability in the ChatGPT Mac application could have allowed attackers to exfiltrate sensitive data, a reminder that AI applications carry the same attack surface as any other client software.
Why it matters: As AI apps gain access to files, calendars, and local system resources, security teams need to treat them with the same rigour as any privileged desktop application.
Understand how LLMs predict the next token and how techniques like KV caching can speed up text generation. Write code to serve LLM applications efficiently to multiple users.
DeepLearning.AI · Free · 1 hour
Put it to work
Try this today
Audit an AI agent's permission surface before production deployment
You are a security-focused AI systems reviewer. I will describe an AI agent's intended capabilities and the external systems it can access. For each capability, identify: (1) the minimum permission scope required, (2) what data could be exfiltrated or corrupted if this permission were abused, (3) whether a human approval step is warranted before execution, and (4) how the action should be logged for audit. Agent description: [paste your agent's capability list here].
Why it helps: With Docker's Sandbox Kit Spec moving toward a formal permissions standard, running this review now surfaces gaps you can encode as policy before regulators or incidents force the issue.
KYFEX Playbook: Workflow of the week
Agent permission audit workflow for production readiness
1
List every external system your agent can read from or write to (APIs, databases, file systems, calendars, email).
▼
2
For each system, define the minimum permission scope needed: read-only vs. read-write, which endpoints, which data fields.
▼
3
Paste the list into your AI tool with the prompt: "For each permission, describe the worst-case abuse scenario, rate its reversibility (reversible / partially reversible / irreversible), and recommend whether human approval should be required before execution."
▼
4
Review the output with your security lead. Flag any irreversible action that currently runs without a human-in-the-loop step.
▼
5
Encode approved permissions as a versioned policy artifact (a Sandbox Kit Spec OCI image if your stack supports it, or a plain JSON policy file checked into source control).
▼
6
Set up structured logging that records, for every agent action: the proposed action, the authority that approved it, the timestamp, and the verified external effect.
▼
7
Schedule a quarterly review of the permission list as agent capabilities expand.
Before you ship it
The risk
AI agents with access to external services can take irreversible actions such as writing records, sending messages, or modifying schedules, and current agent frameworks often conflate proposal with execution, making post-hoc audit difficult.
Do this
Implement a hard separation between proposal and execution in your agent pipeline, log each as a distinct signed event, and require explicit human approval for any action that cannot be automatically reversed.
Ready to ship AI, not just read about it?
KYFEX designs and builds production AI for teams that need it working, not just demoed. Tell us what you're working on and we'll bring the engineering.
