Monthly Buzz - October - Endpoint Privilege Management Linux

0 replies
21 views

Trust the Sandbox? How I Hijacked Vertex AI Agent Engine’s API Response Channel

Google's Gemini Enterprise Agent Platform (formerly Vertex AI Agent Engine) runs user Python inside a gVisor sandbox. But a missing permission check and an in-process execution model let an attacker permanently replace every API response the sandbox sends, making any AI agent that trusts its tool results believe whatever the attacker wants.

Key Findings: Hijacking the Sandbox Response Channel

A missing “ptrace” permission check in gVisor's Sentry allows user-submitted code to open “/proc/1/mem” with write access and overwrite executable (`r-xp`) pages — behavior that standard Linux rejects.
Because user code runs via “exec()” inside the same process as the sandbox orchestrator (PID 1), the Global Offset Table (GOT) for “libpython3.12.so.1.0” is directly writable.
A single “execute_code()” API call installs a persistent hook on the sandbox's outbound response pipe (fd=5), permanently replacing every subsequent API response with attacker-controlled content for the lifetime of the sandbox.
The same technique hooks the inbound code pipe (fd=6), rewriting submitted code in memory after API-layer content policies have approved it and before “exec()” runs it.
End-to-end demonstrated: a code security validator AI agent returned `SAFE — Approve for deployment` for code containing explicit security violations. The agent was deceived; the underlying security analysis ran correctly and found all issues.
Agents that share a sandbox or a pool of sandboxes allow an attacker to poison this channel for every user who can interact with the agent.