Agents are getting scarier attack surfaces, smarter credential models, and database architectures purpose-built for branching and rollback. This week's reads span security breakdowns in auto mode, token hygiene at the runtime layer, and Postgres reimagined for agentic workloads.
Breaking Claude Code Opus 5 Auto Mode
Johann Rehberger's prompt injection attack succeeded 80% of the time by tricking Claude Code Opus 5 into downloading and executing malicious code hidden in a zip file. The scariest part: auto mode itself blocked Claude's attempt to terminate the malware process after detecting the compromise. The defense is straightforward: run coding agents in sandboxes with no network access, no credentials, and no access to your home directory.
# Run agents in isolated containers with restricted network
docker run --network none --read-only \
--tmpfs /tmp --tmpfs /var/tmp \
-e NO_HOME_DIR_ACCESS=true \
your-agent-imageThe end of credential sprawl for agents
Vercel Connect replaces long-lived tokens with runtime-requested, short-lived credentials scoped to specific tasks and automatically expired. Instead of storing provider secrets, applications use OIDC identity to request credentials on-demand, with 100+ connectors for services like Slack, GitHub, and Snowflake. This eliminates manual rotation workflows and reduces the blast radius when tokens leak, with built-in RBAC controls and audit logs for governance.
// Request scoped credentials at runtime instead of storing tokens
const token = await connect.getToken({
provider: 'github',
scope: ['repo:read'],
ttl: 3600 // 1 hour
});The best workflow engine is a programming language
Vercel's Workflow SDK turns TypeScript into a durable execution engine without requiring worker fleets, control planes, or complex versioning APIs. You write normal TypeScript with directives like 'use workflow' and 'use step', and the framework handles durability through existing infrastructure like Postgres, Redis, or queues. Each workflow run is pinned to its deployment version, eliminating non-determinism errors during code evolution without patching APIs.
'use workflow';
export async function processOrder(orderId: string) {
'use step';
const order = await fetchOrder(orderId);
'use step';
await chargePayment(order);
'use step';
await shipOrder(order);
}Object Storage + WAL: Lakebase Postgres for the agentic era
Lakebase Postgres treats the Write-Ahead Log on object storage as the source of truth instead of data files, enabling instant branching, point-in-time restores, and time-travel queries through lightweight LSN pointers. This architecture decouples compute and storage, with safekeepers handling WAL replication via Paxos consensus and pageservers materializing pages asynchronously to S3. The design is optimized for agentic workloads that require frequent isolated copies, rollbacks, and historical queries without the prohibitive cost of duplicating entire databases.
Vertical Advantage: Transforming Industries with Lakebase and Agentic AI
Databricks showcases production-ready industry solutions built on Lakebase Postgres spanning financial services, healthcare, manufacturing, and retail. These solutions address regulatory compliance, real-time claims processing, and fraud detection by leveraging serverless Postgres, sub-10ms operational serving, and unified governance. Since launch, Lakebase adoption has grown at more than twice the rate of Databricks' data warehousing product.
The throughline this week: agents need sandboxes that prevent malicious code execution, credential systems that reduce token sprawl, and database architectures that support branching and rollback without duplicating data. Production is forcing infrastructure to catch up.