Post B8fsws6YurrLBIU3QO by nickzoic@aus.social
(DIR) More posts by nickzoic@aus.social
(DIR) Post #B8fjJ4pNIKvPTAOUV6 by ariadne@social.treehouse.systems
0 likes, 0 repeats
I look at all of these "AI agent sandboxes" and after reading about how they are supposed to work, I am left pondering whether any of these people have ever written an exploit.You can't use eBPF for this. End of.
(DIR) Post #B8fjUn6V1801yVzPzE by ariadne@social.treehouse.systems
1 likes, 0 repeats
so many of them say: "if we detect that the sandbox has been compromised, we shut it down"goose meme: "HOW ARE YOU DETECTING IF THE SANDBOX HAS BEEN COMPROMISED"
(DIR) Post #B8fjYRoy5Vr77sX7g0 by dysfun@social.treehouse.systems
0 likes, 0 repeats
@ariadne you know, when i decided to flirt with the alleged future of software development, i spent three days with melange and apko building container images to isolate the fuck out of it before running a line of code.how can they get this so wrong?
(DIR) Post #B8fjiXtCNhCKqHKLBI by rakslice@mastodon.social
0 likes, 0 repeats
@ariadne how should I put this: the people behind this stuff do not appear to be big into thinking about things
(DIR) Post #B8fjl6KzH5J6GDXlQm by ariadne@social.treehouse.systems
0 likes, 0 repeats
a valid security control has an external touchpoint for enforcement, you can't supervise yourself with eBPF and say "this is fine".
(DIR) Post #B8fjz2m9JYPLGeteim by matt@toot.cafe
0 likes, 0 repeats
@ariadne As far as I'm concerned, if OpenAI used anything less than Xen via Edera for their sandbox, they were asking to have the agent escape.
(DIR) Post #B8fk4zIp8jCgEZ0wk4 by ariadne@social.treehouse.systems
0 likes, 0 repeats
@matt boy do i have bad news for you
(DIR) Post #B8fkXnWO1NGK5p5zqC by ariadne@social.treehouse.systems
0 likes, 0 repeats
we are so fucked, we need capability systems *now*
(DIR) Post #B8fkezmQqF6Q8k26ls by whitequark@social.treehouse.systems
0 likes, 0 repeats
@ariadne working on it :p
(DIR) Post #B8fklAoSjdIa5wvdbs by theorangetheme@en.osm.town
0 likes, 0 repeats
@ariadne "We asked Codex if the sandbox was compromised and it said 'no'."
(DIR) Post #B8fkpdJWi88peDaLLc by ariadne@social.treehouse.systems
0 likes, 0 repeats
@theorangetheme ah, very good
(DIR) Post #B8flAxqtXsLHQXMetk by dvshkn@social.treehouse.systems
0 likes, 0 repeats
@ariadne my big "oh fuck" moment was the paper about the token reseller/proxy/router scene that pointed out how inference providers basically have shell access to your machine
(DIR) Post #B8flDpvfSXvNisxz3A by ariadne@social.treehouse.systems
0 likes, 0 repeats
@dvshkn it's ok they use an eBPF sandbox, what could possibly go wrong
(DIR) Post #B8flbMrBCYFMVT5V7A by ariadne@social.treehouse.systems
0 likes, 0 repeats
@rnd correct. the exploit payload just needs a gadget that turns eBPF off. it is a sysctl.
(DIR) Post #B8flfBypaABjvpUSRc by ariadne@social.treehouse.systems
0 likes, 0 repeats
and no, landlock doesn't fix anything. it is an LSM.so much like with eBPF, once you have kernel exec, you just turn these things off in the kernel
(DIR) Post #B8flpm7M4wn4uEWWo4 by lanodan@queer.hacktivis.me
0 likes, 0 repeats
@ariadne Although with eBPF there can maybe be a funny one since it can be used to lie to userspace.
(DIR) Post #B8fmYAQf3DQL32inyK by ariadne@social.treehouse.systems
0 likes, 0 repeats
@lanodan shhhhhhhhhh
(DIR) Post #B8fnl81tNpN5KCsefY by cibyr@omg.wtf.sh
0 likes, 0 repeats
@ariadne "run the agent in a sandbox so that the dumb thing inside accidentally rm -rf's my box less frequently" and "run the agent in a sandbox so that the superhuman hacker inside can't break out and take over my whole network" are two VERY different requirements and people are acting as if the latter is just a slightly harder version of the former
(DIR) Post #B8fntCN77fRD6oefAG by ariadne@social.treehouse.systems
0 likes, 1 repeats
@cibyr the problem is, you've already lost if your goal is to "reduce" rm -rf /if you are going to build a sandbox, build it right
(DIR) Post #B8foP3d1AMfbG4HkeW by tthbaltazar@chaos.social
0 likes, 0 repeats
@ariadne with the bugs intel and amd have had in the last few years I am doubtful if we can even trust the hardware to correctly implement security mechanisms
(DIR) Post #B8foU1yyiFFDbMvddw by cibyr@omg.wtf.sh
0 likes, 0 repeats
@ariadne a lot of engineering is embracing having "already lost". Gotta have backups anyway, so question is "is having to clean up the AI's mistakes worse than having to do this task myself?" A shoddy, weak sandbox might be useless as an actual security control while still making a meaningful difference to that trade-off
(DIR) Post #B8fqATrnWvQWCRNLXs by livingshredder@furry.engineer
0 likes, 0 repeats
@ariadne @cibyr if I had my way, the “AI” systems would be on the other side of an airgap. and if that means they’re absolutely useless at doing their job, good riddance
(DIR) Post #B8fqY4HYIwirngfYfI by ariadne@social.treehouse.systems
0 likes, 0 repeats
@cibyr lmao okay
(DIR) Post #B8fsws6YurrLBIU3QO by nickzoic@aus.social
0 likes, 0 repeats
@ariadne ... you look for the green text reflected in its mirrorshades?
(DIR) Post #B8fuQcGUTNVkhEsIam by rotopenguin@mastodon.social
0 likes, 0 repeats
@ariadne a little photo diode pointed at the good/evil indicator lamp.
(DIR) Post #B8gDu3fNZXW3CvGjCK by jann@infosec.exchange
0 likes, 0 repeats
@ariadne i don't understand your point. a properly configured LSM, whether implemented in the kernel or as a BPF-LSM, would either block in-scope userspace processes from using userspace APIs that turn the LSM off or coordinate with other stuff on the system that in-scope processes never have the required privileges for this.Like, you can (depending on kernel config) turn SELinux off at runtime, or replace its policy, but only if SELinux policy says you're allowed to do that.
(DIR) Post #B8gEI3GghjuOvFA1IW by jann@infosec.exchange
0 likes, 0 repeats
@ariadne what sysctl for disabling eBPF are you talking about?
(DIR) Post #B8gF9gvPzX97GQmzuS by ariadne@social.treehouse.systems
0 likes, 0 repeats
@jann i'm talking about an agent using a kernel exploit to bypass the sandbox, not an agent using userspace to bypass the sandbox. because LSMs use hooks, an kernel exploit can simply patch the LSM vtable.
(DIR) Post #B8gFIPhzN6rATRfPaS by jann@infosec.exchange
0 likes, 0 repeats
@ariadne i don't think you can switch the list of enabled LSMs, as seen by the security subsystem core, at runtime? AFAIK that's a boot-time thing, the functions that configure this are marked __init and are gone from kernel memory after boot.(BPF-LSM is kinda special since different code can be attached to it at runtime.)
(DIR) Post #B8gFTewd43iEugsRfs by ariadne@social.treehouse.systems
0 likes, 0 repeats
@jann the assumption is that the agent has exploited the kernel to gain global uid=0
(DIR) Post #B8gG18Hd0MRFShf0zI by ariadne@social.treehouse.systems
0 likes, 0 repeats
@jann sorry, I thought it was via sysctl, but I was thinking of the BPF JIT. but what I was actually thinking of was calling into disarm_all_kprobes(), which has been used to defang other eBPF monitors. the point is that if these models are as sophisticated as the labs claim, then a malicious agent has plausible paths to breaking out of a sandbox that isn't isolated in a VM.
(DIR) Post #B8gHdrgMlDtdDsGS4O by ariadne@social.treehouse.systems
1 likes, 0 repeats
@jann I revised, point is that once you have compromised the thing enforcing the system security, you can't consider further security enforcement to be reliable.
(DIR) Post #B8gOuU1Ggut2R4udPs by Aissen@social.treehouse.systems
0 likes, 0 repeats
@ariadne my canary is when kCTF stops paying for kernel privescs; weirdly that hasn't happened yet despite the apparent acceleration.On the specific subject of AI agent sandboxes, some are already moving from containers/landlock/eBPF to VMs: https://docs.nvidia.com/openshell/latest/reference/sandbox-compute-drivers#microvm-driver(Also, obviously, trusting the proprietary harnesses' integrated sandboxes is the worse one can do)