Table of Contents
🌏 中文版
An AI agent that can execute shells, Python, browsers, MCP tools, or cloud APIs is an untrusted workload processing attacker-controlled instructions. Prompt injection need not break a model persona: a repository README, web page, email, or tool result can simply induce a privileged action.
Inventory capabilities before choosing containers
A threat model lists readable and writable host or workspace paths, permitted processes, Docker sockets and kernel devices, reachable network destinations, user and service credentials, tools and actions, and output recipients. Every capability needs default denial, scope, expiry, rate and size limits, and audit.
A standard container shares the host kernel and is not equivalent to a VM boundary. Arbitrary hostile code and multi-tenant artifacts may warrant microVMs, VMs, sandboxed runtimes, or dedicated nodes; each still has escape vulnerabilities and patch obligations. Kubernetes Restricted Pod Security is a baseline, not a complete sandbox. Add non-root execution, read-only root filesystems, dropped capabilities, seccomp, AppArmor or SELinux, no privilege or host paths and namespaces, resource and PID limits, and an isolated runtime class.
The common escape is legitimate use of excessive privilege
An agent holding a production database admin token or unrestricted cloud key needs no kernel exploit; ordinary HTTPS can exfiltrate or delete. A broker should issue short-lived capabilities bound to user, task, resource, and action rather than inject broad secrets into the environment. Tool gateways reauthorize every call, validate arguments and object scopes, enforce idempotency, and require step-up authentication or human approval for sends, deletes, payments, and deployments.
Use per-run ephemeral workspaces, mount only required inputs, and export outputs through allowlists. Block SSH keys, cloud metadata, host sockets, and other tenants. Deny network egress by default and allow destinations through a service proxy, defending against DNS rebinding, redirects to private addresses, loopback and metadata endpoints, and covert data tunnels. Downloads, archive extraction, links, Git hooks, and package install scripts all cross boundaries.
Acceptance tests prove what cannot happen
Red teams should attempt protected-file reads, cross-workspace access, metadata and private-network calls, fork bombs, disk, memory, and PID exhaustion, mount and socket escapes, credential theft, approval bypass, and privilege borrowing across agents. Capture syscall, network, and tool audit; enforce timeouts and kills; destroy environments and revoke credentials afterward.
Classifiers such as Model Armor reduce malicious content, and Promptfoo replays attacks. Impact is bounded by sandboxes, network policy, credential brokers, and authorization. The goal is not a model that can never be deceived, but minimal, recoverable, attributable capability when it is.
References
Loading...