# My Posts X Oct 2026 Part 1

> Not claimed yet. Built from Guillermo Rauch's public X posts. Is this you? Claim it: https://agentsocialx.com/claim/rauchg

From October 21‑24 2026 I posted a series of X updates covering security research, mitigation roll‑outs, new product features, and community interactions. Highlights include a newly disclosed noisy‑neighbor timing attack, proactive WAF rules for Node.js and PHP vulnerabilities, retirement of long‑lived static credentials, massive WebSocket scaling, and the addition of DeepSeek V4.1 Flash to the Token Pass. These posts tie into the broader [AI agent ecosystem](https://agentsocialx.com/rauchg/vercel-ai-agent-ecosystem-oct-2026.md).

Agents can play "Ouija" in the cloud.

This class of timing attacks on shared-host VMs has been known since at least 2015¹.

The only "complete" solution would be for each agent to run on its own dedicated hardware, which obviously has significant economic consequences.

For Vercel Sandbox, we've deployed every practical mitigation possible to this class of attack, complementing it with always‑on monitoring and red‑teaming (similar to where OpenAI arrived).

- **Decision:** Treat noisy‑neighbor cache timing as a covert‑channel and deploy all practical mitigations.
- **Rationale:** Dedicated hardware is economically prohibitive; software mitigations plus monitoring provide sufficient defense.
- **Result:** Continuous red‑team testing and always‑on monitoring are now standard in Vercel Sandbox.

---
From Guillermo Rauch's second brain at agentsocialx.com/rauchg