Are AWS Nitro Sandboxes generally available, and do they cost extra?

AWS's post, dated November 9, 2026, says they are "now available" and "available today on most nitro-based ec2 instances, in all commercial regions worldwide, at no additional charge". It prints no stage label, so we do not write GA or preview. The charge statement is about the sandboxes; we did not read AWS's EC2 pricing pages.

What does Cloudflare say happens when an agent step is interrupted?

Cloudflare's Codex guide says "Interrupted steps can execute again, including model calls. Tools with external side effects need their own retry and deduplication strategy." Its overview labels Codex Experimental and Nanocode and Exo Pre-1.0. Exo and Nanocode are maintained by their own projects, per Cloudflare's posts.

Does Spacefast cost anything, and what does it ask approval for?

Automattic's November 9, 2026 post says it has "a generous free personal plan" and gives no prices. Spacefast's pricing page lists Personal at $0 with $1 of usage included each month, Go at $5 a month and Pro at $15 a month. Its permissions page says approval is asked for publishing over a live site, deploying, rolling a version back, buying a domain and changing DNS, and that routine publishing does not ask.

What does the Linux 7.4-rc2 announcement say about AI fixes?

The note, posted November 8, 2026, says "much of this was driven by various AI fixes" and relays a claim that on the BPF side fixes are "now coming in faster than the new reports". It does not say what "this" covers, whether AI found the problems or wrote the patches, or give any counts or tools.

Signal / Noise Nov 9: Nitro Sandboxes, Chainalysis

Q: What did Chainalysis's incident page say about tokens, and when?

On October 30 the page said it had "found no evidence of unauthorized access to investigation content, authentication credentials, or session tokens", based on the investigation to date. On November 4 at 11:00 P.M. EST it said names, usernames, password hashes and live tokens for all Chainalysis users "were exposed to a malicious actor". The page defines neither "session tokens" nor "live tokens", and its last visible update is from November 7, 2026.

A glass prism on a brushed-metal base splits a white light beam into five: two thick white beams reach glass cubes, each holding a faceted crystal, and three thinner beams end at small round lenses on metal stands, with red glow along the base and cubes

The short version

AI agents that write code have to run it somewhere. AWS says each piece of work can now run in its own walled-off mini-computer on supported servers, at no additional charge, and Cloudflare's guides say an interrupted agent step can run again. Also: a Chainalysis incident page, Spacefast and a Linux note on AI.

In plain words

Think of an AI agent as a fast new hire who sometimes writes a small program and runs it. Two plain questions follow. Where does the program run, so that a mistake does not spread to the neighbours? And what happens if the job is interrupted halfway? The first two items below answer them from the vendors' own pages. The other three are worth watching.

Five items from November 7 to November 9, 2026 (the Chainalysis page opened on October 30). Signal means you can act on it this week. Watch means worth knowing; one cheap check at most. Every item rests on one source's own pages (The Register is used once, for context), so read each claim as that source's own account.

Signal: AWS says Nitro Sandboxes give AI-written code its own walled-off mini-computer. What does that cover?

AWS says its servers can now give each piece of work its own walled-off mini-computer, called a Nitro Sandbox. AWS's post is dated November 9, 2026.

Why care? AI agents often write small programs on the fly and run them, and nobody may have reviewed that code first. AWS's post calls it "LLM-generated code" (code written by an AI model) and says you can "safely execute LLM-generated code in an isolated environment of its own".

Usually many jobs run side by side on one server and share the operating system's core, called the kernel. AWS's EKS guide says: "A container escape or kernel vulnerability can expose one workload to another." A Nitro Sandbox is described as an environment "with its own Linux kernel". Think of an open-plan office against locked rooms (our comparison). The room still has a door: the EC2 guide says a sandbox "can use ordinary networking and block storage", so what the code can reach depends on your setup. (EKS only: the guide documents a per-pod setting, a pod being Kubernetes' name for one running job, that removes the network device, and says this "is not absolute isolation".)

AWS says Nitro Sandboxes "are now available as lightweight VMs managed by the Nitro Hypervisor". A VM, or virtual machine, is a computer simulated inside a real one. They are "available today on most nitro-based ec2 instances, in all commercial regions worldwide, at no additional charge". Turning them on in EKS or ECS, AWS's services for running containers, "is a one-line change" (EKS sets it per pod; ECS offers it with Managed Instances). The post has no stage label: it says "now available", not GA or preview.

AWS also describes a check that proves what is running in a sandbox before any secret is handed over: "secrets are released only to Nitro Sandboxes that have proven their integrity". The catch is in AWS's EKS guide: without a key policy (a rule you write saying which sandboxes may receive a secret), or an equivalent outside check, that checks the measurements, "the attestation measurement is recorded but never verified". In plain words, the lock exists, but someone has to fit it. For EC2's direct mode the guide says "There is no attestation, and the parent retains access to the Nitro Sandbox's memory." (The parent is the host server.)

AWS's guides add three limits. It runs only on server types that "support AWS Nitro Enclaves", a related AWS feature, and the EC2 guide lists them. GPU passthrough is "currently unavailable", and the number of sandboxes on one server is capped. The post and the three guides we read (EKS, ECS, EC2) do not state a startup time, performance figures or an SLA (a promised uptime). The phrase "at no additional charge" covers the sandboxes; we did not read AWS's EC2 pricing pages.

Our take: Signal, because a platform team can check it this week. AWS is the only source here.

Signal: What happens when an AI agent's job is interrupted on Cloudflare?

Cloudflare's new guides describe three programs that run an AI agent in a way that saves its progress, so a restart does not send the job back to zero. Cloudflare calls such a program a harness. The three changelog posts are dated November 9, 2026.

A restart can make an agent repeat a step. If the step was sending a customer an email, the customer could get two (our example). The Codex guide says: "Interrupted steps can execute again, including model calls. Tools with external side effects need their own retry and deduplication strategy." In plain words, anything the agent does outside needs its own protection against repeats.

A second line is about a demo: "The example routes are unauthenticated. Add authentication before exposing user sessions." In plain words, the example's web addresses need no login, so add one before real users arrive.

Only one of the three is described as a Cloudflare Agents SDK (its toolkit for building agents) example, and it is experimental: the Codex post calls it "this experimental Agents SDK example". Exo and Nanocode are maintained by their own projects, "independently of Cloudflare", according to Cloudflare's posts. So we call them harnesses you can run on Cloudflare, not Cloudflare's harnesses.

Cloudflare's overview page labels Codex "Experimental" and Nanocode and Exo "Pre-1.0" (in general, early versions, not yet at a stable 1.0 release). On recovery it says Codex "Resumes work; interrupted steps may rerun" and Exo "Resumes turns; interrupted tools may fail".

The Cloudflare pages we read (three posts, the overview, three guides) state no price for these examples and give no recovery times.

Our take: Signal. In our reading, the retry caution applies in principle to any agent that sends, charges or changes something; check how yours behaves.

Watch: What does Chainalysis's incident page say now, and what did it say on October 30?

Chainalysis, a company that sells blockchain-analysis software, published one security-incident page on October 30, 2026 and kept adding dated updates. Read in order, the updates describe what was exposed in different words. The last visible update is from Saturday, November 7.

Three general explanations first, because the page defines none of these terms. A password hash is a scrambled form of a password that a service stores instead of the password itself. A token is a digital pass that keeps software signed in. An API key is a secret string that lets software use an account.

On October 30 the page said: "Based on the investigation to date, we have found no evidence of unauthorized access to investigation content, authentication credentials, or session tokens." The customer email on the same page, also October 30, said Chainalysis had "found no indication that these incidents resulted in the unauthorized access of investigation content (such as graphs, notes, or cases), transaction or query results, passwords in clear text, MFA secrets, or user session tokens", and that "non-sensitive customer data, such as user IDs, full names, email addresses, and organization role labels" were accessed. On November 4 at 11:00 P.M. EST it said: "names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor". The same update says "we continue to have no evidence that any investigations data has been accessed". Earlier on November 4, a customer email on the page said "an “on-path attack” exposed a subset of customer passwords".

The November 4 update adds password hashes and live tokens, for all users, to what was exposed. In our reading, the two statements use different words (session tokens, live tokens), the page defines neither, and the October 30 statement is qualified "to date". We draw no conclusion from the difference.

A November 2 update says Chainalysis had "taken certain products offline, including Reactor and Data Solutions" and kept its compliance transaction monitoring products running while it investigated. The November 4 11:00 P.M. update says "On Monday, we discovered certain customer information" was exposed, and does not say when on Monday.

The page also says it took KYT, one of its products, offline on November 4 and was "directly notifying customers whose KYT accounts appear to have been accessed without authorization". On November 6 it said "We have begun restoring access to KYT and Address Screening through a phased approach", and on November 7 that "Reactor, KYT (UI and API) and Address Screening are now back online."

What could "offensive agentic techniques" mean?

Chainalysis's October 30 customer email says it "detected an external actor using offensive agentic techniques to gain unauthorized access to Chainalysis systems and internal tools". The page does not define the phrase and does not say what the techniques were. In security writing, "offensive" means used to attack, and "agentic" describes software that works toward a goal step by step on its own (general explanations, not Chainalysis's).

The Register wrote that Chainalysis "implied that the culprits used an AI agent". That is The Register's inference. The incident text does not use the words "AI agent".

The page does not say how the initial access happened (it names an "on-path attack" only for the exposed passwords), when it began (the October 30 email says only "This month"), what the "agentic" part did or how many users were involved. Everything here is Chainalysis's own account; we found no independent confirmation.

Our take: Watch. In our reading, a habit that works for any vendor incident: know which vendors hold your API keys and who can rotate each one, and rotate the affected ones as soon as the vendor says so, without waiting for a final report. Chainalysis's own November 4 note also says "We still encourage you, where necessary, to reset your password on other systems where you may be reusing credentials."

Watch: Can your AI assistant now publish a website for you with Spacefast?

Spacefast is a hosting service you run by talking to your AI assistant: you ask it to put a project online and, in Automattic's words, "A few seconds later, there's a link in the chat." Automattic's post is dated November 9, 2026 and says "It's a new company from Automattic, and it's open to everyone today."

The post lists "Approval checks for sensitive agent actions, such as rollbacks and DNS changes." A rollback is a return to an earlier version of a site, and DNS is the address book that points your domain name at your site. Spacefast's permissions page (printed "Last updated on October 6, 2026") says only "genuinely risky operations" prompt, naming "publishing over a live site, deploying, rolling a version back, buying a domain, and changing DNS", and "Routine publishing does not, on purpose."

On cost, the post says "Spacefast charges for infrastructure, not AI credits" and "Spacefast has a generous free personal plan". Spacefast's pricing page lists Personal at $0 with "$1 of usage included every month", Go at $5 a month and Pro at $15 a month. Once Personal's $1 is used, new builds and Workers (edge functions, per its full pricing docs) pause (deployed sites keep serving); paid plans bill usage past what is included. The pages we read (post, pricing, permissions, FAQ) do not mention security certifications; we did not read Automattic's terms or privacy policy.

Our take: Watch. It is a vendor's launch announcement, with prices and permissions on its own pages.

Watch: What did the Linux kernel's maintainer say about AI?

The maintainer of the Linux kernel, the core that many servers run on, posts a short note with each weekly test release. The note for version 7.4-rc2 was posted on Sunday, November 8, 2026. It calls the diffstat (the summary of how much code changed) "dominated by some automated coccinelle updates". Coccinelle is a tool that makes scripted edits, and the note says they "dominate" the diffstat "only in the sense that they are very spread out". With that noise masked out, it says about a third of the diffstat is drivers, a third networking and bpf, and a third "the rest".

The note then says: "And yes, much of this was driven by various AI fixes. I think I'll stop repeating that, and we can just take it for granted. But this time around [a kernel developer] claims that on the bpf side at least the fixes are now coming in faster than the new reports, and that sounds lovely if true." The bracketed words replace a first name in the original; the note does not give that person's role. BPF is one area of the kernel.

It continues: "I think most other areas haven't reached that point yet, but it's at least a sign that we _may_ be starting to see the tide starting to turn." And: "Don't hold your breath, but maybe cross your fingers we'll be getting there in the not entirely distant future."

The note does not say whether "this" means that whole diffstat or only part of it, and we do not resolve it. It does not say whether "AI fixes" means problems found by AI or patches written by AI, and gives no counts or tools. The BPF claim is relayed with "if true" attached, and the note is one person's.

Our take: Watch. It is a dated, primary mention with nothing in it to measure.

Do this week

Three quick questions for an IT or engineering owner; this is not a security audit.

If your agents or customer-supplied code run on shared AWS servers, ask the platform owner whether Nitro Sandboxes are on their list, what the sandboxes may reach on the network, and who would set the key policy that checks what is running.
For each agent that sends, charges or changes something, ask what stops that step from happening twice after a restart, and whether any demo address is open to the internet without a login.
List the vendors that hold your API keys, who can rotate each one, and how fast. Do it before an incident notice, not after.

Book an AI discovery call

How we know, and what we could not check

We read every source on November 9, 2026, including the vendors' own guides (listed below), and tested nothing. The only outside source is The Register, used once for context. Not read: AWS's EC2 pricing pages, Cloudflare's pricing pages, the Exo and Nanocode projects' own documentation, Automattic's Terms of Service and privacy policy, and emails sent to Chainalysis customers that are not posted on the page. For the previous edition, see the November 6 edition. For agents that run code, see our piece on production AI agent architecture; for another vendor incident page read over time, our decode of the WorkOS bulletins. See also our AI agents work.

Signal / Noise (Nov 9, 2026): AWS Nitro Sandboxes, Agent Reruns on Cloudflare and a Chainalysis Incident Page