mvm blog
High-level posts on microVMs, Nix, sandboxing, and the architecture behind mvm.
A differential mvm-scout run isolates the exact eval() call behind Agno's critical RCE (CVE-2026-35002) and confirms the fix silences it — detection evidence only, no containment claim.
Read the postArchitecture notes, release context, and practical security writing.
A teardown of how Vanna's text-to-SQL visualization feature hands LLM-generated Python straight to exec(), and how mvm-scout's SCOUT-RCE-002 rule caught the pattern and cleared on the one-line fix.
A high-level security design for running untrusted code with microVM isolation, reproducible builds, admission, policy, and audit evidence.