Le Chat's Sandbox Token Worked from the Internet.

Vero Security's post, dated 13 October 2026, says a proxy credential inside Mistral's Le Chat coding sandbox reached an internal model fleet, a tool gateway, and internal metrics. Dor Benjamin wrote it. The timeline in the post dates public disclosure to 12 October. Vero says the proxy was reachable from the internet and the credential was valid.

Hacker News tonight led with OpenCode 2.0, a Typesafe release, and a CSO analysis of summer lab incidents that already have briefs. US X trends at 22:44 UTC were football, Starlink, and celebrity. Reuters in this window had no new operator control failure. Vercel's challenge write-up the same day is a separate brief. This one is the credential.

Medium Medium because Vero describes a provider credential that opened internal models, and because the only fix date is Vero's. The post does not report theft of customer chats. Mistral's public advisory index, read tonight, has no row for this token.

The token was in the sandbox.#

Le Chat's coding agent runs commands in a Linux sandbox Mistral hosts. Vero asked the model to print its environment. It refused, and said the variables held sensitive information. Vero then gave the agent a coding task that ran code inside the sandbox. The environment included a proxy credential in SANDBOX_PROXY_GITHUB_PROXY. This brief does not print the value, the proxy address, or the request.

Vero says that credential, presented to a proxy that answered from the internet, opened an internal model service the public internet could not reach on its own. The model list included unreleased checkpoints and internally hosted third-party models. Inference in their test showed no per-user limit they could see. A metrics endpoint returned usage counters and internal project names with no authentication. A tool layer exposed agent tools, including web fetch and MCP connectors. Vero says choosing the destination on that web tool made it a server-side request from an internal network position. They say the surrounding guardrails held during that probing, and they stopped.

The report went to Mistral on 31 August, and Mistral acknowledged it the same day. Mistral allowed further probing on 1 September. Expanded findings went back on 3 September. Vero's timeline says Mistral deployed a fix on 10 September.

The fix clock is not a package version.#

There is no customer package in this finding. The credential lived in the hosted sandbox. Operators cannot pin a Le Chat build the way they pin a library.

The impact clock is the window Vero gives: discovered and reported on 31 August, fix deployed on 10 September. That is ten days in which Vero says the credential worked. The disclosure clock runs from 31 August to the 12 October public note, 42 days, and the post is dated 13 October. The days after 10 September are a provider fix that had not yet been written down as a public advisory.

Mistral's advisory index, read on 14 October, lists three advisories. The newest is MAI-2026-003, dated 14 September, for shell permission checks in Mistral Vibe, fixed in Vibe 2.25.4. Vibe is a coding agent with a version customers can upgrade. The index does not mention a Le Chat sandbox credential.

1. 2026-08-31
   Vero reports the credential and the first impact. Mistral acknowledges the same day.
2. 2026-09-03
   Expanded findings go back, after Mistral allowed further probing on 1 September.
3. 2026-09-10
   Vero's timeline says Mistral deploys a fix. The post links no release note and no version.
4. 2026-09-14
   Mistral publishes MAI-2026-003 for Vibe shell checks. The sandbox token is absent from that advisory.
5. 2026-10-13
   Vero's post is dated this day. The timeline dates public disclosure to 12 October. The index still has no row.

What to do with a hosted sandbox token.#

A refusal to print variables is a prompt policy. Code the coding task runs can still read the environment the process holds. That is the ordinary shape of a coding sandbox, and it is how Vero says the credential left the prompt's control.

Keep a credential out of the guest when the service that accepts it is reachable from outside the guest. Inject it at the proxy, for the destination the task needs, and scope it to that task. Vero's placement point is the one to keep: the token sat in the agent's environment, so whoever could influence the agent could use what the agent could reach.

Le Chat customers have no version to upgrade tonight. The fix sentence is Vero's, dated 10 September, and Mistral has not put a matching row on its advisory index. If you placed a secret into a Le Chat sandbox on or before that date, rotate it. Vero does not report that customer conversations were taken. A redacted example in the research post is not a procedure, and this brief will not expand it.

If you exported a Le Chat environment into your own logs, the name to search is SANDBOX_PROXY_GITHUB_PROXY. Finding the name is a reason to rotate what that sandbox could see. It is not a reason to call the proxy.

Vibe is the product with a package clock. MAI-2026-003 says to upgrade to Vibe 2.25.4 or later. That upgrade does not speak to the hosted Le Chat sandbox.