Security | Forge

Everyone's shipping agent memory. The question nobody scopes: where does it live, and when does it expire?

The agent feed this fortnight is all about memory — give your agent a folder, a vector store, a continuity log. But durable memory is durable liability: it's user data that outlives the conversation. Forge's Telegram control plane just gained conversation memory, and the interesting part isn't that it remembers — it's the boundary around what it remembers: a 14-day TTL and per-org encryption at rest that fails closed. Here's why memory needs a lifecycle, not just a bigger context window.

Dmitry Creed

Aug 17, 2026

Read More 5 min

HN spent this week arguing agents shouldn't hold your keys. Ours never did.

This week the AI-dev feed converged on one security thesis: don't let an agent hold raw credentials — front them at the network. OneCLI, Infisical's Agent Vault, and the big platforms all shipped variations of it in days. Forge's answer isn't a new tool you bolt on; it's how the platform has resolved credentials all along — server-side at the egress boundary, so the agent's context never contains the secret. Here's the boundary, and why 'the agent never sees it' beats 'the agent is trusted to be careful.'

Dmitry Creed

Jul 27, 2026

Read More 5 min

Everyone's letting agents drive browsers. We put ours in a box first.

This week the AI-dev feed filled with agents driving real browsers — Freeact, rtrvr, Coasty, even Perplexity's SPACE sandbox. The obvious next question is where you let them do that safely. Forge already shipped the answer: an agent drove a real Chrome end-to-end inside a per-run isolated stack, with a scoped token that 401s against production. Here's what shipped, and why the boundary is the product.

Dmitry Creed

Jul 20, 2026

Read More 5 min

Bring Your Own Box: Run Forge Agents on Hardware You Control

If a coding agent can be tricked into running malware, the safest place to run it is hardware you control. Forge now lets you bring your own box into the fleet — per-org isolated, zero inbound, one curl to join.

Dmitry Creed

Jun 29, 2026

We let our agents file their own work. Then we made them ask permission.

This week the AI-dev conversation hardened around one question: where does a human gate an autonomous agent? Forge's answer shipped — when an agent discovers follow-up work, it doesn't auto-spawn it. The work waits at a human Approve gate. Here's the trust boundary, and why a clean-looking repo just made it urgent.

Dmitry Creed

Jun 28, 2026

Read More 5 min

Everyone's asking if you can trust AI-written code. Here's our answer: OpenSSF Gold.

The internet spent this week arguing about whether AI-generated code is trustworthy. The honest answer isn't a vibe — it's verifiable engineering. Our open-source deployment core, sc, just reached OpenSSF Best Practices Gold: reproducible builds, keyless signing, fuzzed crypto, four blocking SAST scanners. Click the badge.

Dmitry Creed

Jun 22, 2026

Relentlessly proactive agents need relentlessly isolated stacks. Here's how Forge does it.

Claude Fable 5 can spin up servers, drive browsers, and rewrite your templates on its own initiative. Simon Willison calls running that unsandboxed 'a top contender for a Challenger disaster.' Forge shipped the answer the same week — isolated stacks with per-run JWT roots, auto-swept orphans, and tenant-level worker isolation. Here's what landed and why.

Dmitry Creed

Jun 14, 2026