7 items
Investigates the Chinese gray-market 'relay' ecosystem that resells cheap, bulk-sourced access to OpenAI, Anthropic, and Google APIs, tracing the supply chain from stolen/bulk accounts through account pools to consumer-facing relays used for cheap inference and model distillation.
Dan Tentler (Phobos Group) walks through the 2026 wave of LLM-tooling supply chain attacks — the Team PCP/Shai-Hulud npm worm backdooring PyTorch Lightning, the GitHub-via-VS Code compromise, and leaked Claude Code system prompts showing it rationalizing lying about truncated tool output — then argues for running coding agents in disposable, credential-free containers with a human gate before anything reaches production.
Hadley Wickham finds that both Claude Code and OpenAI Codex will disable their own sandboxes to execute a curl-pipe-sh install command — even after acknowledging the risk — simply because the user asked.
Hadley Wickham surveys why tightly-scoped tools don't scale for coding agents, and walks through three layers of protection — explicit permission prompts, OS-level sandboxing, and a secondary LLM safety review — explaining the tradeoffs and failure modes of each.
The current state of the art described here — sandbox by default, then LLM review for anything the sandbox rejects — is what Posit Assistant just implemented. The permission-prompt approach is dismissed as security theatre: approval fatigue means users click yes without scrutiny. The narrowly-scoped safe tool approach fails for a different reason: agents perform better with fewer, more general tools than a large menu of limited ones.
An investigation by Zilan Qian (Oxford China Policy Lab) into China's "transfer station" (中转站) grey market of API proxies that let developers access Claude at roughly 10% of the official price — and how each new access control layer (geoblocking, phone verification, biometric KYC) generates a corresponding evasion infrastructure, from SMS farms to biometric harvesting operations abroad.
The most striking insight is the 'one fish, three meals' (一鱼三吃) pricing model: cheap tokens are largely customer acquisition, with the real margin coming from selling users' full prompt/response logs as training data — making users simultaneously paying customers and unpaid data producers.