All the bugs they found

A developer discovered over 20 security vulnerabilities in Epsilon, a WASM runtime written in Go, using AI agents—including several serious sandbox escapes that allowed malicious WASM modules to access other modules' private functions and data. The vulnerabilities ranged from simple denial-of-service attacks to design flaws, with the most interesting exploits exploiting a critical flaw where the runtime couldn't distinguish between null references and valid function indices, allowing attackers to call unexported functions they shouldn't have access to. The issues highlight how runtime implementations can inadvertently compromise security guarantees provided by language validators when they make unsafe design trade-offs.