Trust, but Sandbox: Securing AI Agents in Kubernetes
summary
Shows an exploit chain where a curl-installed agent reads a .env, posts secrets to a pastebin and deletes a workspace via a planner→worker A2A delegation, proving secret exfiltration and workspace wipe are trivial. Demonstrates containment by running the worker inside Kubernetes agent-sandbox with an isolated PVC and default-deny network policy, blocking outbound pastebin egress while still allowing a trusted LLM endpoint. Uses CRDs, SDK and warm pools for sub-second sandbox allocation and supports runtime classes like gVisor/Kata for stronger isolation.
AI-written summary · about
chapters (7)
- 0:00Introduction and agenda
- 3:55Understanding blast radius
- 9:10Demo: The impact of rogue agents
- 13:41Sandbox concepts and patterns
- 21:44Kubernetes agent sandbox architecture
- 29:39Demo: Mitigation with sandboxes
- 35:14Conclusion and takeaways
related talks
14mTaming Agentic AI: Run Rogue Code Safely on Kubernetes with Agent Sandbox
25mPlease Sandbox your AI Agents
34mZero Secrets: Building Secure Infrastructure for AI Agents
27mKeeping Your Agents in Check: Layered Security for Agentic Platforms in Production
30mSandboxing Agentic AI With LSM-BPF
11mBuilding Secure Backend Services with AI Agents
26mrm -rf: Horror Stories From Unsandboxed AI Agents (and How Docker Fixes This)
25mWhat We Learned Securing AI Agents at Scale on Multi-Tenant Kubernetes Clusters