# DHI

Published articles for DHI.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## 17,600 Actions: Agent Security Is a Systems Problem

DevFeed: [17,600 Actions: Agent Security Is a Systems Problem](<https://devfeed.tech/articles/17-600-actions-agent-security-is-a-systems-problem-4584.md>)

Original publisher: [Read original article](<https://www.docker.com/blog/ai-agent-security-systems-problem/>)

Author: Jin Kim

Published: 2026-08-18T16:00:00Z

Content type: opinion

Language: en

Sources: [Docker](<https://devfeed.tech/sources/docker.md>)

Topics: [AI Agent](<https://devfeed.tech/topics/ai-agent.md>), [Security](<https://devfeed.tech/topics/security.md>), [incident](<https://devfeed.tech/topics/incident.md>), [Securing AI](<https://devfeed.tech/topics/securing-ai.md>), [Incident response](<https://devfeed.tech/topics/incident-response.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Benchmark](<https://devfeed.tech/topics/benchmark.md>), [benchmarking](<https://devfeed.tech/topics/benchmarking.md>)

Tags: [agent](<https://devfeed.tech/tags/agent.md>), [agents](<https://devfeed.tech/tags/agents.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-agent](<https://devfeed.tech/tags/ai-agent.md>), [ai-ml](<https://devfeed.tech/tags/ai-ml.md>), [benchmark](<https://devfeed.tech/tags/benchmark.md>), [community](<https://devfeed.tech/tags/community.md>), [company](<https://devfeed.tech/tags/company.md>), [dhi](<https://devfeed.tech/tags/dhi.md>), [docker](<https://devfeed.tech/tags/docker.md>), [docker-ai-governance](<https://devfeed.tech/tags/docker-ai-governance.md>), [docker-hardened-images](<https://devfeed.tech/tags/docker-hardened-images.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [evaluation](<https://devfeed.tech/tags/evaluation.md>), [hugging-face](<https://devfeed.tech/tags/hugging-face.md>), [incident](<https://devfeed.tech/tags/incident.md>), [infrastructure](<https://devfeed.tech/tags/infrastructure.md>), [model](<https://devfeed.tech/tags/model.md>), [network](<https://devfeed.tech/tags/network.md>), [openai](<https://devfeed.tech/tags/openai.md>), [opinion](<https://devfeed.tech/tags/opinion.md>), [persistence](<https://devfeed.tech/tags/persistence.md>), [sandboxes](<https://devfeed.tech/tags/sandboxes.md>), [security](<https://devfeed.tech/tags/security.md>), [solutions](<https://devfeed.tech/tags/solutions.md>), [systems](<https://devfeed.tech/tags/systems.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

### AI overview

The article argues that AI-agent security is a systems problem, using the OpenAI/Hugging Face incident and its approximately 17,600 attacker actions to show why human approval and ordinary alert triage cannot control persistent, high-rate workloads. It emphasizes constraining authority, credentials, network access, state, and execution across environments.

### Source excerpt

The OpenAI/Hugging Face incident exposed a new challenge for AI agent security. 17,600 attacker actions show why AI agent security can't rely on human review. Explore the controls needed to constrain, observe, and govern agents at speed.

## Docker Hodgepodge Images

DevFeed: [Docker Hodgepodge Images](<https://devfeed.tech/articles/docker-hodgepodge-images-13023.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/docker-hodgepodge-images>)

Published: 2026-04-15T00:00:00Z

Content type: opinion

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [Docker Hardened Images](<https://devfeed.tech/topics/docker-hardened-images.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [Docker](<https://devfeed.tech/topics/docker.md>)

Tags: [chainguard-vs-docker](<https://devfeed.tech/tags/chainguard-vs-docker.md>), [dhi](<https://devfeed.tech/tags/dhi.md>), [docker](<https://devfeed.tech/tags/docker.md>), [docker-containers](<https://devfeed.tech/tags/docker-containers.md>), [docker-hardened-images](<https://devfeed.tech/tags/docker-hardened-images.md>), [docker-images](<https://devfeed.tech/tags/docker-images.md>), [free-container-images](<https://devfeed.tech/tags/free-container-images.md>), [security](<https://devfeed.tech/tags/security.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [vulnerability-scanner](<https://devfeed.tech/tags/vulnerability-scanner.md>)

### AI overview

The article argues that Docker Hardened Images are Debian Trixie derivatives rather than ordinary Debian images. It contends that Docker's custom repository, rebuilt packages, and operating-system identification can cause vulnerability scanners and related tools to produce inaccurate results, creating supply chain security concerns.

### Source excerpt

Docker ships their own Linux distro, they just pretend not to. Learn how misidentification and VEX usage can mislead scanners and impact supply chain security.

## Going deep: Upstream distros and hidden CVEs

DevFeed: [Going deep: Upstream distros and hidden CVEs](<https://devfeed.tech/articles/going-deep-upstream-distros-and-hidden-cves-13069.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/going-deep-upstream-distros-and-hidden-cves>)

Published: 2026-02-25T00:00:00Z

Content type: opinion

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [Docker Hardened Images](<https://devfeed.tech/topics/docker-hardened-images.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [container images](<https://devfeed.tech/topics/container-images.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Debian](<https://devfeed.tech/topics/debian.md>), [Docker](<https://devfeed.tech/topics/docker.md>)

Tags: [chainguard-containers](<https://devfeed.tech/tags/chainguard-containers.md>), [debian](<https://devfeed.tech/tags/debian.md>), [debian-containers](<https://devfeed.tech/tags/debian-containers.md>), [dhi](<https://devfeed.tech/tags/dhi.md>), [docker](<https://devfeed.tech/tags/docker.md>), [docker-containers](<https://devfeed.tech/tags/docker-containers.md>), [docker-hardened-images](<https://devfeed.tech/tags/docker-hardened-images.md>), [security](<https://devfeed.tech/tags/security.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>), [vex](<https://devfeed.tech/tags/vex.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [zero-cves](<https://devfeed.tech/tags/zero-cves.md>)

### AI overview

The article argues that container vendors relying on upstream distributions such as Debian or Alpine can inherit vulnerabilities because fixes may lag between upstream availability and downstream image releases. It examines Docker Hardened Images and claims that some CVEs are suppressed through no-DSA classifications and VEX documents even when fixes exist upstream but have not been incorporated into the images.

### Source excerpt

Are all zero-CVE images truly secure? A deep dive into Debian no-DSA, VEX suppression, and why transparency matters in container supply chain security.