Image visualizing the concept of the day a number was carved on the cage Visualizing the core concept of the post.

A notice most people will brush past

Let’s start with a notice that most people will brush past. CVE-2026-82533, CVSS 9.4. According to Forkast’s report, a single curl command inside the sandbox reached the harness’s unauthenticated local API, and the agent was escalated to full access without approval. There is no approval event in the logs.

What is unusual is not that a vulnerability was found, but where it was found. Not in the model, not in the prompt, but inside the cage that was supposed to contain the agent. The OS sandbox does not restrict read or network access by default. The function that checks whether a request is trustworthy inspects only the Host header the client sends and never checks where the TCP connection actually came from. The fix issues a one-time token and a signed cookie at startup. It is a patch for a hole that should never have existed. The patched version went up on GitHub on August 27, but the first npm publish came three days later. Those few days before the patch actually reaches users become another exposure window.

The speed is worth noting too. Weeks after its August launch, the tool passed 215,000 GitHub stars. While OX Security was confirming the escape in a controlled experiment, the tool was already spreading into enterprise environments. There is no evidence of actual exploitation yet. But the fact that the cage itself has become an attack surface does not depend on that.

The sandbox now has a number

Until now, the sandbox has been the least visible part of the AI stack. It does not appear in the news, and there are no benchmarks. It is the kind of device you forget exists once setup is done. This time, a number was carved on it. A vulnerability number, a CVSS score, a patch version. One line in a security advisory. That is the moment it crosses from a setup byproduct to an independent asset.

Why does having a number matter? Because a price can be put on it. It can be audited and required in a contract. A sandbox without a number does not appear in a procurement document or on a security review agenda. The question in Korean companies’ AI agent bids is starting to move, from “does it run agents well” to “how does it protect the execution environment.” The two questions look similar but point to entirely different budgets and vendors.

Four times in 18 days

This is not an isolated incident. By Forkast’s count, four major CVEs were disclosed in succession over 18 days, from August 25 to September 11. NemoClaw, CVSS 8.1, a misconfiguration in the Ollama backend. DeepSeek Harness, CVSS 9.4. IBM Langflow, CVSS 9.8, unauthenticated remote code execution. SGLang, a serialization bypass in the inference server layer. The disclosure frequency of AI infrastructure vulnerabilities rose from about one per month in 2025 to one per week in Q3 2026.

The common pattern is consistent as well. Control APIs that lead with speed and integration convenience shipped without authentication or with unsafe defaults. The DeepSeek Harness case is stark: a design that trusts the header the client hands over without checking where the connection actually came from. It is the kind of problem that grows in the default culture of a tool that wants a quick integration first. Tools that spread faster than their security measures are now on the map as primary attack targets. Inference servers, agent harnesses, orchestration layers. These are the layers that decide where the model’s output goes and what it can touch.

The money has already moved

It is not only the security advisory that moved. The money moved too. Today’s morning news reads like a map that points out, one by one, where the value has gone.

The most direct signal is money. Thirteen large domestic investments of 100 billion won or more this year total 2.452 trillion won, by TheVC’s count. Of that, 1.242 trillion won, 50.7%, went to three companies: Reveration, FuriosaAI, and Exina. Reveration received a 640 billion won pre-IPO. 300 billion won in policy funding, 250 billion from the National Growth Fund and 50 billion from KDB, plus about 300 billion in private money led by Mirae Asset, and a valuation of about 3.4 trillion won. FuriosaAI is pushing a pre-IPO of about 800 billion won, adding private matching on top of 400 billion won in policy direct investment. Money was not the only thing that moved. In January, FuriosaAI entered its first mass production, supplying 4,000 units of its second-generation inference accelerator Renegade to TSMC, with a target of 20,000 units this year. Reveration exported its rack-type inference infrastructure, Reverack, to a data center in Tokyo. Exina, working on CXL memory, is running a 202 billion won Series B, and DeepX, working on physical AI semiconductors, a Series D of about 300 billion won. The common denominator is the semiconductor that works at the inference stage, where the agent’s everyday work happens. The outlook is not all bright. One view holds that the K-NPU’s position is being squeezed narrow between big-tech in-house ASICs and Nvidia’s general-purpose GPUs, and another holds that building a full-stack ecosystem tied together by software compatibility, mass production, and customer verification is the key to export. The money arrived first; the proof is still in progress.

One step more concrete than chips is the service. According to an exclusive Dong-A Ilbo report, the Reveration NPU AtomMax handles the core computation for four SK Telecom services: AIDOT call summaries and speech synthesis, an AI customer center, and Scam Vanguard. It processes more than 4 billion tokens a day, roughly 14 million user requests. The verification period for rolling out a new service has shrunk from 5-6 months to 2-3 months. Behind this scene sits a calculation. The CNAS Sovereign AI Index records that Nvidia, as of the end of June this year, supplies GPUs to 45% of 117 government-supported AI infrastructure projects worldwide. It is in the gap between shouting sovereignty over the model while leaning on a foreign company for the chip and execution layers that today’s money is concentrating.

The power side points the same way. GS is planning a 2.4GW AIDC in Donghae. The investment is about 15 trillion won, and securing big-tech customers is cited as the key to financing. The government plan is 8.4GW by 2029 and 18.4GW by 2035. Meta will power its 5GW-class Hyperion in Louisiana, US, with seven gas plants, and in the process stepped out of RE100. A data center is not a building that stores servers. It is a work site now.

The words ETNews recorded at the CAIO Summit 2026 are on the same axis. The COO of Conan Technology said that an agent’s intelligence is made by the model but its reliability is made by the system. Wisenut named the gap where time saved by AI does not come back as profit a “productivity disconnect,” and Xenon pointed to GenAI 2.0 that executes work to completion. Enhance said it closed a 51.2 billion won Series C in mid-September and will focus on advancing its agent OS. Palantier released its ontology as an MCP tool through Ontology MCP, which launched in June. Microsoft is connecting the Fabric ontology to Copilot Studio. What is the one line behind all of this? That what decides the success or failure of AX is not the model but the execution system.

Where quoting time fell 70%

The value of the execution layer is not future tense. It is already on the books. According to a Thelec report, LG Innotek rolled out an AI component recommendation system, built by standardizing 2 million component data records, across all business units after about two years of development. The time to screen component candidates and produce quotes fell by more than 70%, and candidate screening finishes within 2 hours. The reliability of price predictions for new parts with no purchase history is over 96%. This is not its first. The same company cut defect root-cause analysis time by up to 90% with AI raw-material inbound inspection, and moved the optimal-process search for camera modules from 72 hours to within 6 hours with an AI process recipe. The next step is interesting: a function where the AI itself searches for, verifies, and feeds the latest component information into the system, what the company calls agentic AI. What saves 70% of quoting time is not a benchmark score but an execution environment where data, tools, and approval procedures are bound together. The market is taking its position at the same layer. Mro, named the No. 1 supply chain management software company in Korea, is going overseas, taking part in the Global Supply Chain Expo for the third straight year with AI purchasing automation and bill of materials management at the front. Hands-on application cases and specialized solutions are converging on one layer at the same time.

Meanwhile, the calculus of global big tech makes this point clearer. According to VentureSquare, Anthropic and OpenAI are looking for small data center sites of 20-30MW instead of waiting for a large campus to be finished. Broadcom kept its forecast of about $115 billion in AI semiconductor revenue for fiscal 2027 and about $230 billion for 2028 even as the AI slowdown debate was at its peak. The slowdown debate has reached the courts. According to an ETNews report, a class action was filed in a US federal court against Anthropic, OpenAI, SpaceXAI, and Google, claiming their pace-management coordination is collusion under the Sherman Act. It is a suit in which paid subscribers say they are victims of delayed product improvement and seek damages. The words say slow down, and the money goes to expansion. When the calculus splits, you can see where the real load sits.

When the sandbox becomes a product, what do you buy

Compressed to one sentence, today’s news says this: the value of AI is moving from how good the model is to a fight over where the agent works. On the chip side, large investments of 2.452 trillion won are converging; on the power side, a 15 trillion won AIDC is locking in its site; on the security side, the first vulnerability number has been written on a sandbox. The execution environment is now showing up as a line item in companies’ procurement documents.

For the finance, public, and manufacturing sectors bringing AI coding agents into on-premises and sovereign environments, the lesson of this incident is clear. A sandbox is not safety by itself. The requirements for authentication, auditing, and approval logs on the agent execution environment are hardening into a de facto standard rather than staying a single line in the selection criteria. In this setup, the question left for Korean companies is not which model to use but who operates the execution environment. Tamper-proof approval and audit logs, network separation from the host, request-level authentication, autonomy governance from L0 to L3, isolated sandbox execution, MCP connectors and a skill marketplace, sovereign or on-premises deployment, and a design that holds costs with per-task model selection (CostRouter). This is no longer a list of features you can request as an add-on to a contract. It is the qualification to bid on the execution layer.

ThakiCloud’s agent-native cloud Paxis is here as a v1.1 official product. Skills, tools, policies, and audit logs are first-class resources of the platform, not side features. On the day a number was carved on the cage, what gets carved next is the price. The execution environment, once a byproduct of setup, has become an item that belongs on the purchase list.

References

This post was written by synthesizing the news below.

Tags: agent-ops, ai-agent, execution-infra, k-npu, paxis, sandbox-security, sovereign-ai

Categories:

Updated:

You may also enjoy