ThoughtWorks 技术雷达 Vol.35 摘要
ThoughtWorks 技术雷达第 35 期（2026 年 11 月）中文摘要：四大主题、117 个条目与团队行动建议。
Topic
#security
20 篇笔记
Program Status Protocol
A terminal escape sequence that lets a program tell the terminal what it is doing: idle, working, waiting on the user, finished, or failed, and why.
LLMs are making formal software verification feasible at a much larger scale
Claude formally proved security properties in the compiled code of 123 open-source libraries. Along the way, it found bugs that had eluded detection for years.
A deep dive into OpenSEO
Explore OpenSEO's architecture: SEO data APIs, Cloudflare Workers, its audit crawler, MCP tools, AI agents, storage, and self-hosting trade-offs.
How the Claude Code team does code review
How do you review code at the volume agents produce it? On the Claude Code team, once we had high coverage and deep reviews, we started optimizing for the minimum amount of human review time that doesn't raise reverts or incidents.
AI Agent 沙箱怎么选？我们把 runc、vArmor 和 Kata 跑了 30 轮
在 104 线程 Linux 物理机上实测 runc、runc + vArmor 与 Kata QEMU：Kata 用近一倍启动时间和数百 MiB 内存换独立内核，vArmor 则以接近 runc 的成本收紧行为边界。
Agent 的 Sandbox 到底是怎么实现的？
从 Codex、Claude Code、Gemini CLI 到 OpenHands很多人讨论 AI Agent 安全时，关注的是：“模型会不会执行危险命令？”但真正重要的问题其实是：即使 Agent 决定执行危险命令，底层系统是否允许它成功？这就是 Sandbox（沙箱）存在的...
The Audit Log Page
An audit log has two readers. Most logs are designed for the wrong one. Five theses on product audit logs.
Computers Compared
Agents get computers now, and definitions vary. A Fly.io Sprite gives each agent its own hardware-isolated Linux machine that keeps its filesystem, stays reachable, and sleeps when there is nothing to do.
Fragments: August 18
fragments 18 Aug 2026
Cloudflare OS: an open platform for agents, apps, and work
Cloudflare OS is an open-source platform that lets everyone in your company build apps, automate work, and safely access internal systems, shaped around what your organization knows and how it operates.
YC 开源 QM：当每个员工都有 Agent，公司需要怎样的协作系统？
未来一家公司里，可能每个员工都有自己的 Agent。它们能读文件、查数据库、写代码、回复邮件，也能在后台持续运行任务。问题随之而来：这些 Agent 应该看到什么？记住什么？使用谁的账号？哪些能力可以共享？危险动作由谁批准？7 月 31 日，Y Combinator 开源的 QM...
Agency: Secure, scalable sandboxes for agents
This is part of our series on how we're AI-pilling Sierra.In our last few posts, we talked about what happens when every employee has a sing...
The zero-cost fallacy: Open source software in the agentic era
Open source software is the foundation of much of our digital infrastructure. However, is AI undermining the incentive structure? What needs to change?
Advanced Observability for Production Systems
From SLIs to LLM monitoring: 9 practices that separate mature teams from dashboard collectorsMost teams have dashboards. Few have observabil...
SkyPilot Sandboxes: Run Agent Code on Your Own Kubernetes, at Scale
SkyPilot runs untrusted, LLM-generated code in sandboxes on the Kubernetes clusters you already own. A single cluster sustains 50,000+ sandboxes, with multi-cluster support to go further. Individual launches in less than a second. All at up to one-tenth the cost of hosted alternatives, with your code and data never leaving your cloud.
Building cloud agent infrastructure: what's different, and what we learned
Most agent frameworks today assume a desktop. One user, one machine, one process. The agent runs while the laptop is open, writes to a local...
A Practical Guide to Becoming an AI-Native Engineer
If AI writing everything is the answer, then why are most engineering teams shipping more bugs, more incidents, and more technical debt than...
容器沙盒知识点补充
容器沙盒知识点补充 本文档为 2026-04-29 容器沙盒方案深度对比 的配套知识库，从底层原理出发帮助小白理解容器沙盒涉及的核心技术。 知识来源：知乎专栏、AWS 官方文档、Google gVisor 博客、Linux 内核文档、Red Hat 技术博客等。 1.1 Linux Namespaces（命名空间）— "看不见别人" [!note] 一句话理解 命名空间让进程以为自己独占整个系统…
How We Built Our Sandboxed Claude Agent without Leaking Its API Keys
Listen Labs 分享如何构建安全的沙盒化 Claude Agent，通过 Workstation 架构实现 API 密钥零暴露