Pwning and Defending AI Agent Code Interpreters (Kinnaird McQuade)
summary
Claims live exploitability of code interpreters: prompt-to-RCE, credential theft, and covert C2 payloads. Uses interact and a bespoke DNS C2 that encodes base64 into A-record octets and fetches with getant to deliver commands and exfiltrate output; the attacker uploads a malicious CSV containing the payload. Demonstration breaks AWS Bedrock AgentCore sandbox despite a Firecracker VM, DNS C2 over A records proves reliable, AWS issues a partial fix then documents the behavior, and a $100 gift card accompanies disclosure. Firecracker microVM intact
AI-written summary · about
chapters (12)
- 0:00Introduction and speaker intro
- 1:29Background on AI code interpreters
- 6:51Risks of local coding sandboxes
- 12:11Mental model for AI agent risks
- 16:22Local coding sandbox isolation models
- 23:49Defensive strategies for sandboxes
- 27:07Exploiting AWS Bedrock Agent Core
- 31:21Reverse shell via DNS protocol
- 37:45Live exploit demonstration
- 39:55Disclosure and vendor response
- 40:36Key takeaways and future outlook
- 43:05Closing remarks and Q&A
related talks
33mAgentic ProbLLMs: Exploiting AI Computer-Use and Coding Agents
36mAgentic AI Under Attack: Live Demos of Exploits Through Autonomy and Trust
51mPrompt Injection: When Hackers Befriend Your AI
01h 06mHow hacking works
34mSecure Your Coding Agent Like It’s Malware
33mOffensive Javascript Techniques for Red Teamers
33mThe AI Kill Chain
47mUnderstanding Prompt Injection - Techniques, Challenges, and Advanced Escalation