» Tag
virtualization
18 postsJailbox: Hardened, Network-Isolated KVM VMs for AI Coding Agents
Jailbox creates hardened, network-isolated KVM VMs to contain AI coding agents and untrusted code, with no route back to your host or LAN.
Tailvisor gives macOS/Linux VMs their own Tailscale identity
Tailvisor is an open-source VM sandbox giving macOS/Linux guests their own Tailscale identity via a gVisor-based networking layer.
Apple Silicon macOS VMs Get 11-16x Faster LLM Inference via Llama.cpp
Cua's Metal capability shim delivers 11-16x faster llama.cpp LLM inference in macOS VMs on Apple Silicon, with open benchmarks and source.
CommitBrief — AI code reviews, right in your terminal
A provider-agnostic, local-first CLI that reviews your staged changes, a historic range, or a whole GitHub pull request. Zero telemetry, no server. Free and open source.
commitbrief.comClawk Gives Coding Agents a Disposable Linux VM, Not Your Laptop
Clawk runs coding agents in isolated, disposable Linux VMs instead of your host machine, using hypervisor-level isolation instead of prompt rules.
Study: 80% of Qubes OS Security Bulletins Trace to Xen, CPU
Analysis of 109 Qubes Security Bulletins shows 79.8% trace to Xen or CPU issues, not Qubes code, with disclosure rates plateauing since 2018.
Kernel devs review two LLM-assisted memory management patch sets
Two LLM-assisted Linux kernel patch sets—1GB huge page allocation and VM memory tracking—reveal how maintainers judge AI-assisted code.
Januscape: 16-Year-Old UAF in KVM Shadow MMU Crashes Hosts
CVE-2026-53359 (Januscape) is a 16-year-old UAF in KVM's shadow paging code enabling guest-to-host escape; the public PoC reliably panics the host, disrupting all co-located VMs.
Januscape: 16-Year-Old Critical Linux KVM Escape, PoC Public
CVE-2026-53359 (Januscape) is a critical Linux KVM guest-to-host escape in the shadow MMU, present since 2010; a public PoC causes host kernel panic.
Google Pays $250K for 16-Year-Old Linux KVM Escape Flaw
Dubbed Januscape, a Linux KVM flaw lets guest VMs break out and hijack the host. Google awarded the discovering researcher a $250,000 bug bounty.
LinuxOnTab Boots a Real Linux Kernel Right in Your Browser
LinuxOnTab boots a real x86 Linux kernel in your browser tab via v86 and WebAssembly, with no install, server, or Docker required.