The Bytecode Alliance patched a high-severity flaw in Wasmtime, the engine many products embed to run customer plugins. The bug let a plugin reach files outside its sandbox, and the Alliance shipped the fix the same day it disclosed it. Cloudflare bought Deno for the open-source code that would let companies run its Workers platform on their own servers. And Shopify opened its catalog and Shop Pay checkout to any shopper's AI agent through a single connection.
Sandboxes: The Bytecode Alliance patches a filesystem escape in Wasmtime, the engine that runs customer plugins
The Bytecode Alliance disclosed a high-severity sandbox escape in Wasmtime and shipped patches across three supported versions the same day. Wasmtime is the engine products embed to run customer-supplied plugins in isolation, and it sits underneath plugin frameworks such as Extism. The flaw, rated 8.8 of 10, let a plugin rename a symbolic link so the system moved a directory from outside the sandbox to inside it. Once inside, the plugin could read and change files it was never meant to reach. It affected only macOS and FreeBSD, because the Linux and Windows versions of the underlying operation do not follow the kind of link involved. The one disclosure bundled fifteen advisories in all, most of them lower-severity ways for a plugin to crash its host. The fixes went out to the current line and two long-term-support lines at once. Extism shipped releases on October 8 and 9 that carried the still-vulnerable engine, so builds on it stay exposed until they pick up the patched version.
Why it matters: running untrusted customer code is the hard part of letting people extend an app, and this flaw hit an engine much of that work is built on. A same-day fix still reaches an app's users only after that app, or the framework it embeds, picks up the patched version.
Infrastructure: Cloudflare acquires Deno to make self-hosted Workers a first-class path
Cloudflare acquired Deno, the company behind the Deno JavaScript runtime and the Deno Deploy hosting service. Cloudflare said it will keep maintaining the open-source runtime for a year with bug and security releases, then stop developing it. What it wanted is celld, open-source code from the Deno team that reimplements Durable Objects, a core coordination piece of the Workers platform. Cloudflare plans to build on celld to make running its open-source Workers runtime on your own servers a first-class supported option, rather than only on Cloudflare's network. The announcement did not address Deno Subhosting, the service built to run a company's customers' untrusted code in isolation.
Why it matters: Cloudflare now owns both its Workers platform and the open-source code that reimplements a core piece of it. Self-hostable Workers would let a company run the customer-code platform on its own infrastructure instead of renting it from Cloudflare, which widens where that kind of extensibility can live.
Commerce: Shopify opens Shop Pay checkout to any shopper's agent
Shopify opened Shop MCP, a live server that lets a shopper's AI agent search the catalog, build a cart, and complete a Shop Pay checkout on the shopper's behalf. Shop MCP sits at a single address that any AI assistant can connect to through the Model Context Protocol, the shared standard that lets an assistant reach tools a vendor did not build in. It works across Shopify's catalog of more than a billion products, and the agent can also pull up a signed-in shopper's past orders. So instead of handing the shopper off to a store's website to finish, the agent carries the purchase through to payment itself.
Why it matters: a shopper's assistant can now complete a purchase across any Shopify merchant through one connection, rather than through an integration each merchant wires up by hand.
Governance: Atlassian lets admins approve where a Forge app sends data
Atlassian made customer-managed egress generally available on Forge, moving the decision about where an app may send data to the customer's own administrator. Forge is the platform developers use to build apps for Jira and Confluence. Until now a Forge app had to declare every outside address it would contact up front in its configuration. With customer-managed egress, a site's administrator can approve new destinations while the app runs, and that choice is saved for the installation. Atlassian notes that an app using these capabilities is not eligible for its "Runs on Atlassian" trust badge.
Why it matters: a marketplace app runs inside a customer's tenant and can send that customer's data outward, and that decision now sits with the customer's administrator rather than only the developer. The tradeoff is the "Runs on Atlassian" badge, Atlassian's signal that an app keeps data inside its platform. An app gives up that badge the moment it asks to send data to destinations chosen after it is installed.
Standards: WebMCP's editors make defending against a hostile page the agent's job
WebMCP's editors are moving the job of defending against a hostile page off the standard and onto the agent. WebMCP is the draft standard that lets a web page offer tools a visitor's agent can call. A change updated October 13 names two risks: a page feeding an agent bad instructions, and a page using its tools to track a user across sites. It casts both as problems the agent's own security model must handle, not ones the web interface prevents. One of the spec's editors approved it, and it waits on privacy review before merging. Several smaller fixes to the specification's internal rules merged through October 15, and an open draft would rework how the specification identifies each registered tool. WebMCP remains a Community Group draft: it runs behind an origin trial in Chrome and Edge, with no ship date set, and has experimental support in Brave, while Firefox and Safari do not ship it.
Why it matters: this is about who defends the user when a page turns hostile. Putting that on the agent rather than the standard hands the problem to the browser makers shipping WebMCP, Google and Microsoft among them. They have to solve it while the feature is still an early origin trial that Firefox and Safari have not adopted.
Also worth knowing
- The WebAssembly group is standing up a dedicated subgroup for its Component Model. An October 15 proposal creates the subgroup for the Component Model, the layer that lets WebAssembly plugins written in different languages work together, names two chairs, and schedules a first meeting for October 26.
- Microsoft tightened the enterprise lock on its coding agent's sandbox. In the October 14 release of Visual Studio Code, when an administrator turns on sandboxing or sets permission rules for the Copilot agent, the agent now has to run in the mode that can enforce them. The release also retired an older Windows method for sandboxing the agent's terminal commands in local sessions.
- The W3C's cross-browser extension groups met but put off the install-versus-update permission idea. The chartered Working Group held its October 15 call, working through specification text for extension interfaces, and the Community Group's October 8 notes were published. A proposal to let an extension add a permission on an update without re-prompting existing users was deferred to the group's annual plenary.
- The Model Context Protocol built out its governance structure. The project chartered a standing governance group and promoted another group to full working-group status between October 11 and 13, and its skills-distribution extension aligned to the stable base specification.
- Epic's Fab marketplace began selling editable game systems creators can open and build on. As of October 15 Fab sells complete, editable systems built for Epic's Unreal Editor for Fortnite, such as NPC behaviors and vehicles, each reviewed against Epic's technical standards before listing, with the publisher earning 88 percent of each sale.
- A preprint measured how much reach "agent skills" grant. A preprint that profiled 6,309 skill listings on ClawHub and skillsmp found seven in ten carry at least one elevated capability, with about half able to run programs on a user's machine and roughly a third able to read files or send data over the internet. Agent skills are the instruction bundles an agent loads and then acts on with its own access.
On the radar
- October 20: The W3C WebAssembly Community Group holds its next call.
- October 22: The W3C WebExtensions Community Group holds its next public call.
- October 26: The WebAssembly Component Model subgroup meets for the first time.
- November 3: The WebAssembly Community Group is set to discuss a change to how WebAssembly honors Content Security Policy.
- December 1: New Microsoft 365 Copilot Business licenses switch to usage-based billing by default.
- December 31: Bug and security fixes end for the 0.x line of Cloudflare's Sandbox SDK.
- March 1, 2027: Shopify stops injecting storefront script tags the old way.
This Week in Extensibility is curated by Todd Schiller. Research, drafting, and fact checking are AI-assisted.