Monthly Buzz - October - Endpoint Privilege Management

0 replies
22 views

Trust the Sandbox? How I Hijacked Vertex AI Agent Engine’s API Response Channel

Google's Gemini Enterprise Agent Platform (formerly Vertex AI Agent Engine) runs user Python inside a gVisor sandbox. But a missing permission check and an in-process execution model let an attacker permanently replace every API response the sandbox sends, making any AI agent that trusts its tool results believe whatever the attacker wants.

Key Findings: Hijacking the Sandbox Response Channel

A missing “ptrace” permission check in gVisor's Sentry allows user-submitted code to open “/proc/1/mem” with write access and overwrite executable (`r-xp`) pages — behavior that standard Linux rejects.
Because user code runs via “exec()” inside the same process as the sandbox orchestrator (PID 1), the Global Offset Table (GOT) for “libpython3.12.so.1.0” is directly writable.
A single “execute_code()” API call installs a persistent hook on the sandbox's outbound response pipe (fd=5), permanently replacing every subsequent API response with attacker-controlled content for the lifetime of the sandbox.
The same technique hooks the inbound code pipe (fd=6), rewriting submitted code in memory after API-layer content policies have approved it and before “exec()” runs it.
End-to-end demonstrated: a code security validator AI agent returned `SAFE — Approve for deployment` for code containing explicit security violations. The agent was deceived; the underlying security analysis ran correctly and found all issues.
Agents that share a sandbox or a pool of sandboxes allow an attacker to poison this channel for every user who can interact with the agent.
Google VRP assessed the finding as "working as intended" and closed the ticket as Won't Fix. This post is published under 90-day coordinated disclosure.

Continue reading HERE

Customer Case Study

Karma Automotive Strengthens Support and Saves $600,000 in Labor Costs with BeyondTrust

Latest Available Versions

EPM for Windows and Mac (Cloud and Pathfinder) v26.3.1 – September 2026
EPM for Windows 26.3.1 - September 2026
EPM for Mac v 26.3.2 - September 2026

BeeKeepers Community

“The release notes for 26.3 mention that JIT Admin notifications have been added so users know right away that they have been approved/denied without needing to constantly check the endpoint utility app. It explicitly says JIT Admin. Does anyone know offhand if those notifications have been added for JIT Application approvals?”
Good question. For 26.3, this is only for JIT Admin notifications on EPM Windows.
Click here for the most popular discussions in BeeKeepers

Upcoming and In Case You Missed It Webinars

Understanding Entra Privileged Identity Management, What PIM Covers and Where It Stops
Identity Visibility & Intelligence: The Missing Layer in Modern Identity Security
Securing Machine & AI Agent Identities – November 5, 2026
Battling Identity Security Blind Spots – November 10, 2026
AI Agents Among Us: Identify, Understand and Control Every AI Agent Action – November 18, 2026
EMEA - AI Agents Among Us: Identify, Understand and Control Every AI Agent Action – November 19, 2026
Demo: AI Agent Security
Q3 EPM User Group
Q4 EPM User Group