Supply Chain

In the LiteLLM 1.107.0 compromise the bill of materials, the provenance attestation and the image signature were all accurate, and none of them described the files that ran. The payloads in this year's supply chain attacks lived in install hooks, Python startup files and agent instruction files.

NIST asked in February whether agent identities should be tied to specific hardware, software, or organizational boundaries. The summary of the 614 responses it received records commenters proposing an anchor bound to the artifact that produced the agent, with the SBOM carried as metadata for access decisions.

Daytona moved its core development to a private codebase in June and GitHub archived the repository on 3 October. For anyone picking a sandbox platform, the test is whether they can still patch and verify the environment two years from now.

Section 1532 of the FY2026 NDAA has barred DoD contractors from DeepSeek and High Flyer models since January 17, 2026, and a DHS order now reaches third-party products built using DeepSeek implementations in federal civilian systems. Neither instrument asks where the model runs. Both ask where the weights came from.

The Phase 2 pause cut the schedule assessment firms were hiring and pricing against. Named assessors describe layoffs and cancellations, the accreditation body's own numbers show capacity still growing, and the one figure that moved the wrong way is the number of assessments in progress.

The SBOM was built for software a vendor assembles at build time and ships. An open source agent that writes code and pulls dependencies at runtime breaks that model, and adds a question the format cannot answer: who wrote the code.

Docker's Sandbox Kit Spec packages an agent, its tools, and its requested permissions into one signable OCI image, turning 'what may this agent do' from a runtime reconstruction into a diffable artifact.

Don't mistake a procedural pause in CMMC Phase 2 for a regulatory retreat. The compliance shadow is growing.