The November 4 account describes a rollout completed over preceding months. Each sandbox now has its own Linux kernel inside a microVM, a lightweight virtual machine managed by Cloud Hypervisor.
An agent is a model running a multi-step task with tools. Containers still separate processes inside its workspace, while hardware-assisted virtualization separates customers from each other.
The virtual-machine manager runs without administrator privileges or Linux capabilities. Outbound network policies are enforced outside the guest, and credential brokers attach service keys after checking authorization.
Replit reports roughly 500 milliseconds to acquire a prepared workspace with customer disks mounted. Warm pools do work beforehand, so this measures handoff rather than a fresh machine boot.
Its kernel review covered 6,211 published vulnerabilities from June 1 through November 4. Replit says 5,969, or 96.1%, were avoided through upstream fixes or excluded code.
Caveat: These are Replit’s own operational claims, and the vulnerability percentage combines patching with configuration choices rather than measuring resistance to attacks.
(HN 18 points · 6 comments · complete engineering account and deployment boundaries)
Cheaper decisions need confidence scores that survive harder cases#
The November 4 study checks whether customer records incorrectly combine different people. Its first test contains 1,000 synthetic profiles, evenly divided between correct matches and mistaken combinations.
Jev returns a confidence score for a condition. Sending its 30–90% confidence cases to Claude Opus 5.5 routes 22% of profiles for another opinion.
That combination reaches 98.8% accuracy at $0.88 per 1,000 profiles, versus Opus alone’s 99.0% at $3.86. Average processing time falls from 2.2 to 0.63 seconds per profile.
On deliberately harder cases, the same routing rule reaches 95.3% accuracy at $2.94 per 1,000 profiles. Opus alone reaches 95.1% at $5.39, so the headline fourfold saving shrinks.
The comparison system using GPT-6 Luna plus Opus reaches 91.6% on harder cases at $1.15 per 1,000 profiles. Hightouch attributes the accuracy gap to Luna’s overly confident mistakes.
Caveat: The tests use constructed data and tuned thresholds, so production accuracy and savings still require checks against your own records.
(HN 123 points · 35 comments · complete methods, routing tables and harder-case comparison)
A sandbox escape depends on the host’s remaining defenses#
The second PwnEscape account explains how existing access to host memory can redirect a running Firecracker thread. It extends an earlier Linux networking flaw rather than identifying a new Firecracker code defect.
The demonstration targets Firecracker 1.16.1 with host kernel 7.0.0-1011-aws and guest kernel 6.18.44+. Firecracker runs directly as administrator without its usual jailer, the program restricting its host access.
The researcher reports making the host process write an eight-byte marker, then restoring temporary stack changes. Firecracker remained running and the guest still accepted remote logins.
Vercel’s challenge report distinguishes host-memory disclosure demonstrated in production from host execution demonstrated on researcher-owned machines. It reports no demonstrated access to customer data.
An upstream Linux repair checks packet metadata before completing a deferred checksum. Firecracker’s jailer documentation separately describes dropping privileges and restricting the process.
Caveat: Administrator execution in this deliberately unjailed setup does not establish an escape from an equivalently patched, hardened production deployment.
(HN 92 points · 50 comments · technical account, provider’s evidence distinctions, upstream patch and containment documentation)
PSI’s claimed proof of a quantum-computing conjecture → UNVERIFIABLE: the checked announcement describes human review and Lean acceptance, but this run did not inspect the complete manuscript or formal proof files. The claim remains unverified here, rather than established or disproved.
Microsoft’s reported employee buyouts → UNVERIFIABLE: direct extraction and a public text-proxy fallback both failed, leaving the full account unchecked.
Google’s longer generated-video clips → OFFSTACK: the checked November 5 release concerns video generation and editing, a lower-priority fit than the selected agent infrastructure and model-cost evidence.
Datadog’s continuous specification checks → LOW_UTILITY: the full account is useful distributed-systems engineering, but its generated-code relevance is prospective and this run found no directly usable released tool.