Observed arrival · 2026-10-26
Detonation Labs puts AI-agent packages in the sandbox
A security tool runs AI-agent skills and MCP servers in an isolated environment to record suspicious behavior before installation.
○Open
⊠Login
$Paid
†Ads
✦Pretty
●Pro
◎Niche
◉Human
⚑Risk
ƒJS
- For
- People reviewing AI-agent skills and MCP servers
- Worth noticing
- Its test runs can advance the clock 45 days and speed up sleeps to expose behavior that waits for a trigger.
Field notes
The described test sequence starts with install scripts run inside a credential-baited box, then checks the instructions and tools an agent would encounter. Further passes vary the environment—including CI variables and a clock advanced by 45 days—to try to wake dormant behavior. In one displayed example, a package reads a planted npm token and attempts to send it to a test hostname; the page says the sandbox intercepted the attempt.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
○OpenPublic substance visible
✦PrettyNotable craft visible
●ProPolished or operationally mature
◎NicheUnusually specific use
One card from the complete issue