Page 4 of 128
In my judgment, OpenAI wrote about a research environment for training frontier models; for a personal agent, limiting credentials and exits comes first, and covert channels become a main risk only once there is a second tenant that must be isolated.
I sort agent sandboxes into four kinds: shared-kernel OS isolation, container orchestration, local microVMs (lightweight virtual machines) and remote microVMs. Claude Code's sandbox is off by default and wraps only shell commands; Codex CLI's is on by default locally. Most public escapes go around the boundary through config files or check scripts rather than through its core, and a sandbox answers how far a fooled agent can get, not whether it gets fooled. On Claude Code, turn the sandbox on, put ~/.ssh and ~/.aws on the deny list, and block the Read tool separately.
When you install a skill, connect an MCP server or let an agent run commands, risk can be seen as coming in through four entry points. I sort the open-source tools around them into seven kinds by when they step in, from pre-install scanning and sandboxes to guardrails, audit and red teaming. This post covers what each kind handles and three limits that keep recurring: no single tool works as the only defense, defaults often work against you, and published detection numbers lack independent evaluation.
AI penetration-testing tools use an LLM as the attacker against ordinary software. They share two problems: the tool is itself an attack surface (a target can take it over through prompt injection, and HexStrike's server has no authentication), and once open-sourced, its use cannot be controlled (the same tool serves authorized testing and attacks alike, and the anti-abuse settings of ARTEX and HexStrike are defaults the operator can edit). When you read news that a tool was abused, ask who said so and whether the evidence is independent. The ARTEX incident has several vendor analyses, but some of them examine overlapping attacker infrastructure or cite each other, so they are not independent pieces of evidence.
King and Worthington compared 134 paid expert pre-reviews of 124 manuscripts with Claude Opus 4.8 reviews: the GPT-5.5 judge chose the AI review in all 132 decided pairs, and three former journal editors chose it in 26 of 30 judgments. The result covers constructive pre-submission feedback, not journal refereeing.
Two reports that both say "attack success rate 5%" cannot be compared directly: behind the number sit who set the questions (the attacker model), who judged (the judge, a model or rule that decides), and what the denominator counts. garak's own FAQ says its scores have no scientific validity, and in HackAgent's white paper the order of two models flips with the judge threshold. I found no independent accuracy evaluation of any of the four.
The two representatives take opposite approaches: Cloudflare's security-audit skill is a pure-LLM multi-stage process, and Cloudflare says that when its internal harness wired in Semgrep, the hunting agents did not call it once in a month; Trail of Bits combines Semgrep and CodeQL scripts with LLM judgment. I found no checks specific to Workers, D1, KV or Astro in the rules or supporting files of either, and neither publishes accuracy figures from real projects. This post is based on documentation only and was not run against any project.
When you see 'covers OWASP 10 of 10', 'merged into Microsoft and Cisco' or '9X% detection', ask five things: who said it, what the term means, who set the questions, what is being measured, and where the primary source is. The earlier posts and a few cases added here each happen to show one: Microsoft's toolkit itself says 7 full and 3 partial; of ATR's (an open-source set of agent threat-detection rules) merged PRs into Microsoft and Cisco, the three checked were all opened by its author; Cisco's own detection rate and an independent study's differ several-fold; common benchmarks score models or agents, not tools.
Duet, Muse, Dots, Grok Bot, OpenClaw and Hermes can all work through your email and accounts in the background. They differ in who holds five layers: the computer, the credentials, the approvals, the data and the model. Hosted agents put a reviewer model and your approval in front of sending and paying; OpenClaw and Hermes run tools directly on the host by default, OpenClaw without even an approval prompt, and you have to turn on the sandbox yourself using the official hardening guides.
These four pre-install scanners work in one of three ways, usually combining two: static rules, LLM judgment, or actually connecting to the MCP server. Cisco's own documentation shows rules alone catch about 8% of malicious samples they have not seen, and third-party tests show the numbers shift a lot when the sample mix changes. Use scanners as a first filter; "no findings" does not mean safe.
Almost all aid gear is rated for body weight only: aiders are for standing, daisies and fifis are for hanging, and the climbing rope is always what catches a fall. The lead cycle is place, clip an aider, step down and bounce test, step up, clip the rope. Never clip one carabiner into two pockets of a sewn daisy; BD says a mis-clip can be as weak as about 2.2 kN. Jug on two ascenders and tie a backup knot to your harness every 5–7 m. Never create a fall onto an ascender or progress-capture pulley: HowNOT2 stripped the sheath at about 4.7 kN. For a first pair of ascenders (one per hand), choose between the BD Index and Petzl ASCENSION, about NT$2,700–3,000 each in Taiwan.
Belay devices are manual (tubes) or assisted braking; assisted braking splits into assisted tubes (ATC Pilot, Smart 2.0, Jul²) and cam devices (GRIGRI, NEOX, Pinch). For the gym and single-pitch sport, the DAV and WeighMyRack both recommend an assisted-braking device first, and assisted tubes cost about half as much as cam devices. If you're heading for multi-pitch, you'll also need a two-strand tube with guide mode, such as the ATC-Guide or Reverso; the Giga Jul does both. Assisted doesn't mean automatic: Edelrid shows that an assisted tube held at the wrong angle lets the rope run through with almost no braking, so the brake hand never leaves the rope. Check the manual for compatible diameters before you buy: the GRIGRI takes 8.5–11 mm, optimal 8.9–10.5 mm, while the Pilot and Smart top out at 10.5 mm.
Most people start with one each of BD Camalot C4 .3 or .4 to #3, then combine with a partner's set to make a double rack; Taiwan's route info uses BD numbers. TOCC's Longdong rack is Z4 #0–.75 plus C4 .3–#3, 14 cams; on a budget, start with Z4 .2 plus C4 .3–#2, 7 cams. DMM Dragons share BD's colours but not its numbers (Dragon 1 = C4 .5, Dragon 3 = #1); Totem and Metolius use their own schemes. By BD's listed weights, swapping .4 to #4 to Ultralights saves only about 139 g, so skip them for a first rack. Longdong air is salty: wipe your cams after every trip, since BD axles and trigger wires rust easily there.
The carabiner that clips your belay device to your belay loop should be a locking Type H (HMS), marked with an H on the body. If you're buying one and using a tube-style device, the Petzl Attache (58 g, US$25.95) is the best overall pick on both review lists we used, and the part where the rope runs is round stock, so it runs more smoothly. With a GRIGRI, pear-shaped carabiners tend to rotate into cross-loading, so choose one with a horn like the DMM Rhino, or add Petzl's BAR accessory to an Attache. Anti-cross-loading is a bonus, not a must: the standard requires at least 7 kN on the minor axis, and Mike Vert says sport climbing usually doesn't generate much force, so a rotated carabiner is mostly just awkward. Anti-cross-loading models have compatibility issues: clipped the normal way round, a BD GridLock can still let a GRIGRI cross-load, and Treeline Review says the Mammut Smart HMS works well with tube devices but not with a GRIGRI.
If you top-rope or lead, you need a waist chalk bag; boulderers can use a bucket, which takes both hands at once. For a first bag, check three things: your hand fits (big hands go up a size, e.g. BD Mojo M/L or Organic XL), a stiff rim holds the opening open, and the closure cinches tight. On belt vs harness, BD argues for the belt (sits higher, swings less) while REI says clipping it to your harness is fine; if you clip it, use a climbing-rated carabiner. Some gyms abroad allow only chalk balls or liquid chalk; the rules at Taiwan's T-UP Wanhua and Passion Climbing don't mention chalk, so ask at the desk. Entry bags include the BD Mojo (US$23.95) and Mammut Crag (US$19.95 list); the go-to bucket is the Petzl SAKAB (US$54.95, magnetic roll-top).
Wear the waistbelt above your hip bones, tight enough that you can't slip out upside down; for most people that's around belly-button height. Hang in it in the shop if you can. Choose gear loops by use: 2 for indoor top-roping, about 4 for outdoor sport, 6 for trad and multi-pitch (Petzl Taiwan). If you don't yet know where your climbing is heading, make your first harness one that adjusts at waist and legs, such as the BD Momentum or Petzl Corax. If you're sure it's gym and sport, look at fixed-leg harnesses like the BD Solution or Petzl Sama/Selena; those leg loops can't be adjusted later, so always try them on. Starting trad or multi-pitch, look at the Petzl Adjama/Luna, with adjustable legs and 5 loops.
Helmets come in three constructions (Petzl Taiwan): hard shells are the heaviest, toughest and cheapest; foam shells are lighter with middling durability; hybrids are lightest but the most fragile and most expensive. A first helmet is usually a hard shell or a foam shell: the Petzl Boreo and BD Capitan E are durable hard shells, the Petzl Meteor and Mammut Crag Sender lighter foam shells; save a hybrid like the Sirocco for when you know you'll be on long routes. Always try it on: for the same head circumference, brands differ in shape, and Japanese shop staff and bloggers warn that Western brands may not suit Asian heads. Fitted properly, it shouldn't move when you shake your head, and the chin strap has no slack.
Make your first set curved nuts: if you'll lean on cams and money is tight, BD Stopper #5–11 (the set Adventure Taiwan's trad course uses); if you want a British-style set to climb on, DMM Wallnut 1–11. TOCC's 2024 guide says Long Dong's cracks are covered in crystals, Stoppers tend to get tugged out of place there, and the grooves on DMM Wallnuts and Alloy Offsets hold better. Offsets come second, replacing the mid sizes in one set. Small sizes vary a lot in strength, so read the manufacturer's table first; among #7–11 offsets, Trango rates its own at only 7 kN. Buying second-hand Wild Country Superlight Rocks? Check the batch against the 2023 recall first.
The simplest first set of sport draws is the BD Hotforge Hybrid (12 cm US$25.95, keylock solid gate on top, wiregate below). With more budget and a taste for big, easy-to-clip carabiners, look at the Petzl Spirit Express or Djinn Axess. Add 2–3 draws with a steel insert on the rope end, such as the Edelrid Bulletproof, for the first bolt and the spot where you keep falling. Never use the bolt-end carabiner for the rope. Taiwan's BSMI announced a recall of Decathlon SIMOND quickdraws on 2026-10-19 (models 8589547, 8589548, 8608405, 8935765, 8935909); stop using them if you have them.
For a first rope, look for a dynamic single rope with 1 on the rope end. Choose between 9.5 and 10 mm: for gym-only use, EpicTV suggests 10 mm and up; for working routes with lots of falls, UKClimbing prefers 9.7 mm and up; Hard Is Easy says not to go below 9.5 for a first rope, and UK instructor JB Mountain Skills thinks 9.5 is enough. For length, ask how tall your gym's walls are; outdoors, go by route length, and BD calls 70 m today's crag standard. "Dry" doesn't mean the rope passed the UIAA water-repellent standard (no more than 5% uptake). Start your shortlist with the Mammut 9.8 Crag Classic, 9.5 Crag Classic, Sterling VR9 and Beal Booster III (stocked by Mabu Valley in Taiwan); the BD 9.9 is left out: it lists for no less than the ropes in the table, has the lowest sheath proportion, and ranks 16th of 16 at OutdoorGearLab.