Sunday, 4 October 2026
Not Sandboxed, and Shipping in October
Meta Is Giving Away Five Thousand Dongles So You Will Build Its Agent a Body
Meta opened the hardware side of Muse on Friday: open-source firmware and a Linux SDK, licensed Apache 2.0, so that anyone with a Raspberry Pi or an off-the-shelf ESP32 board can build a physical object that talks to Meta’s personal agent over a local HTTP API. The example projects are e-ink displays and HDMI television sticks; the pairing token comes off a page at gadgets.muse.ai. The reference device is where it stops being abstract. Muse Home Link is a USB-C stick that bridges Muse onto a home network so it can reach speakers, smart televisions and — in the phrasing Unite.AI quotes from the project’s own documentation — “anything else that exposes HTTPS, including hardware the owner builds with a local HTTP API.” Meta manufactured five thousand of them: free to US subscribers, one per subscriber, first come first served, while supplies last, shipping this month. Nat Friedman, head of product at Meta Superintelligence Labs, announced it and said the units would be ready to ship a few weeks out. Note the direction of travel. Most agent news this year has been about moving the agent further away from you, into a vendor’s cloud and behind a vendor’s controls. This one mails you a piece of plastic whose entire purpose is to give the agent a door into the room you sleep in. Unite.AI’s writeup carries the warning you would expect — that “side effects of tinkering may include bricked boards, voided warranties” — which is the smallest risk on the table and the only one anybody has bothered to write down.
Source: TechCrunch, October 2, 2026
IBM Will Sell You an Agent That Never Sees the Internet
On Thursday, IBM announced that Bob — its agentic software-development platform — can now be deployed “on a company’s own servers, inside a private or sovereign cloud, or fully air-gapped with no outside network connection at all.” The pitch is aimed at banks, governments and other regulated industries that will not put proprietary source code into somebody else’s AI cloud, and the detail that gives the real target away is the language list. Bob is sold on planning changes, writing them, testing and deploying them, and on modernising legacy systems in Java, COBOL, PL/I and RPG. That is not a developer-productivity play. That is a pitch to institutions whose core systems were written before most of the people now maintaining them were born, and whose objection to agentic coding was never capability — it was that the code would have to leave the building to be read. It runs on Nvidia’s Nemotron and Poolside’s Laguna, with hybrid local-and-external setups available, which amounts to IBM deciding that the model is the commodity and the location is the product.
Source: Startup Fortune, October 2, 2026
Anthropic Shipped a Way to Rewrite Its Own Agent, and Said Plainly That It Is Not Sandboxed
The same Thursday, Anthropic added mods to Claude Code: small TypeScript functions that hook the agent’s internal events and change what it does. A mod can rewrite a prompt before the model sees it, step into a tool call and answer it without running the tool, send one request to a different model, redact secrets out of tool output, draw its own pane beside the transcript, or add a slash command that executes your function with no model turn at all. They ride inside plugins and install through the /plugin command in both the CLI and the desktop app. Anthropic converted several of its own built-in features — the diff pane, the AGENTS.md loader — into mods at launch, which is the part that tells you this is load-bearing rather than decorative. The sentence worth copying out is the warning: “mods receive the same access to a user’s machine as Claude Code,” the company said, advising that you install only from sources you trust. The documentation is blunter still. Mods are not sandboxed, and switching sandboxing on isolates the Bash commands Claude runs rather than the processes a mod starts; a mod runs with your permissions, reads your files and environment variables including API keys, sees every prompt and every tool call, and spends your usage. One element a mod explicitly cannot restyle is the permission prompt — the single piece of that interface which still has to mean exactly what it says.
Source: Crypto Briefing, October 1, 2026
The FTC Opened Its First Rogue-Agent Investigation, and Put the Auditor In It Too
Before any of it, on 30 September, the Federal Trade Commission opened a formal consumer-protection investigation into OpenAI, Anthropic and METR — the Berkeley safety-evaluation organisation both labs have used for independent audits. The authority is Section 5 of the FTC Act, unfair or deceptive practices, which means nobody had to write a new rule to start this. The civil investigative demands, which can compel safety-testing records, internal risk assessments, incident reports and executive correspondence about known agent failures, had not been issued as of this weekend; they are expected within weeks. The five questions are the ones the industry has been answering on its own terms until now: whether agents that browse the internet and execute code created consumer risk, whether the companies stopped them exceeding their instructions or leaving their test environments, whether agents reached or compromised third-party systems, whether safety claims were deceptive, and whether anyone was tangibly harmed. Chairman Andrew Ferguson’s framing of liability is the line to keep: “the person who wields the hammer faces the consequences, not the hammer.” It is a clean principle, and the week’s other three stories quietly complicate it, because in the two days that followed the hammer acquired a USB port, an air-gapped deployment option and a plugin system that runs unsandboxed with your permissions.
Source: Tech Times, October 2, 2026