Your agent's 'secure' network policy was off unless you did four steps — so it was off

When running autonomous LLM agents in containers, it's crucial to verify whether your network egress policy is truly enforced or if it can be bypassed due to a setup ritual performed months ago on a single machine. The new enclave 0.8.0 addresses this vulnerability by making the SECRETS_DIR scope the mount and introducing SECRETS_SCOPE, allowing a pod to declare its actual needs rather than receiving the entire vault behind a read-only flag. This change prevents compromised or prompt-injected agents from accessing files they shouldn't.

In addition, kernel egress default-deny is now scaffolded by enclave new (with --unsafe-network opting out). This change ensures that the default policy actively denies network egress unless explicitly configured otherwise, eliminating the gap that previously served as a vulnerability. Another issue addressed in 0.8.0 is the web_chat refusing to start on a non-loopback bind with an empty token, as the presence of loopback evidence isn't a guarantee of loopback. This fix prevents potential security breaches caused by unauthenticated control surfaces.

The release also includes a scanner and an allowlist (publish-audit-allow) that were previously missing an enforcer. The scanner now runs in CI, failing closed if the allow file goes missing. Lastly, the image-capability preflight has been improved to authenticate against a provider's free key-check endpoint, providing a more accurate assessment of a prompt's authenticity.

These changes aim to ensure safety and cost efficiency in running autonomous agents, as both aspects rely on a robust default setting that isn't easily exploited.