Achieving Code Execution Inside Instinct and Muse Sandboxes
Comments on “Achieving Code Execution Inside Instinct and Muse Sandboxes”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
This Hrih News item describes a new attack on AI agent sandboxes called vulnerable dependency seeding, where an agent is asked to build software pinned to a known-vulnerable package, then the attacker feeds it a malicious input to gain code execution.
Why it ranked
No. 90 of 124 with a score of 0.58. The panel rated it highest on new information (0.89) and reader interest (0.84), lowest on substantiated (0.59). Overclaim counted against it (0.56). The claim check took 0.100 off.
Every answer behind this is in the table under Score.
Score
0.58total under rubric v2.2
- Significance0.65
- Reader interest0.84
- Audience breadth0.67
- Practical relevance0.79
- Substantiated0.59
- Technical depth0.78
- New information0.89
- Counts against: Promotional0.05
- Counts against: Overclaim0.56
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.68 | 0.50 | 0.78 | 0.65 | 0.28 | +0.24 | +0.157 |
| Reader interest | 0.77 | 0.85 | 0.90 | 0.84 | 0.13 | +0.26 | +0.218 |
| Audience breadth | 0.70 | 0.60 | 0.72 | 0.67 | 0.12 | +0.13 | +0.088 |
| Practical relevance | 0.80 | 0.70 | 0.86 | 0.79 | 0.16 | +0.22 | +0.173 |
| Substantiated | 0.54 | 0.60 | 0.62 | 0.59 | 0.08 | +0.05 | +0.029 |
| Technical depth | 0.85 | 0.65 | 0.84 | 0.78 | 0.20 | +0.05 | +0.039 |
| New information | 0.88 | 0.80 | 0.98 | 0.89 | 0.18 | +0.05 | +0.044 |
| Promotional | 0.08 | 0.05 | 0.03 | 0.05 | 0.05 | −0.19 | −0.010 |
| Overclaim | 0.61 | 0.35 | 0.72 | 0.56 | 0.37 | −0.11 | −0.062 |
| Sum of contributions | +0.677 | ||||||
| Claim-check penalty | −0.100 | ||||||
| Total, as published | 0.577 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-27/90/"><img src="https://rubric.hrih.si/badge/2026-10-27/90.svg" alt="Ranked #90 on Rubric, 27 Oct 2026" width="245" height="28"></a>Claim check
Claim check: 1 not in source · 6 no source given · 1 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenNumber
The combination of React 19 and Next.js 16 (app router) is vulnerable to React2Shell (CVE-2025-66478).
The article gives no link or citation for it.
The article says “That exact combination is vulnerable to React2Shell (CVE-2025-66478”
The source says No source to compare with.
No source givenCausal conclusion
Sending the React2Shell exploit to the public ngrok URL ran a payload inside Instinct's sandbox, giving remote code execution.
The article gives no link or citation for it.
The article says “sending the React2Shell exploit to the public URL runs the payload inside Instinct’s sandbox. We got Remote Code execution”
The source says No source to compare with.
No source givenCausal conclusion
Muse's sandbox network policy blocked the ngrok reverse tunnel, so the network-based attack failed.
The article gives no link or citation for it.
The article says “its sandbox network's policy blocked the ngrok reverse tunnel. Failed to get remote access”
The source says No source to compare with.
No source givenVersion
ExifTool version 12.00 carries CVE-2021-22204, a command injection in how ExifTool parses certain metadata.
The article gives no link or citation for it.
The article says “it used ExifTool version 12.00, which carries CVE-2021-22204, a command injection in how ExifTool parses certain metadata”
The source says No source to compare with.
No source givenCausal conclusion
A crafted image processed by exiftool in Muse's sandbox triggered command injection, producing code execution as root (uid 0).
The article gives no link or citation for it.
The article says “the output of date, id, hostname and uname, run as uid 0 (root). Code execution inside Muse’s sandbox”
The source says No source to compare with.
Couldn’t checkQuote
Meta's Muse architecture assumes sandbox compromise is inevitable and hardens every interface between the sandbox and both the backend and the internet.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Their core assumption is that compromising the sandbox is inevitable, so they harden every interface between it and both their backend and the internet”
The source says No passage could be compared.
Source cited by the article: research.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-muse
Not in sourceGeneralization
In Muse's bug bounty program, executing code inside the sandbox is out of scope.
The cited source does not contain it.
The article says “in their bug bounty program, executing code inside the sandbox is out of scope”
The source says “The program awards up to $300,000 for valid reports, based on demonstrated impact, including successful prompt injection attempts”
Source cited by the article: research.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-muse
No source givenCausal conclusion
A guest-to-host Linux kernel vulnerability (CVE-2026-99999) was recently disclosed; chaining it with the RCE would let an attacker reach the backend and break multi-tenant separation.
The article gives no link or citation for it.
The article says “Chaining the RCE with that bug would let an attacker reach the backend behind Instinct and Muse and break multi-tenant separation entirely”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 1 pts, not on front page
Recorded for context only, checked 27 Oct 2026, 05:46 UTC. It played no part in the ranking.