Do Sandbox Restrictions Actually Work for AI Agents Running in Linux and gVisor?
An experienced security researcher has published a detailed case study asking whether access-control mechanisms inside Linux sandboxes used by AI agents actually deliver the expected restrictions. The work focuses on scenarios where an agent runs inside an isolated environment—built on container runtimes or virtual machines—yet individual tools launched by the agent must operate with narrower rights than the full session.
The author explains that simply instructing an LLM “do not modify files” does not reduce process privileges. Instead, a trusted wrapper must apply concrete Linux controls such as Landlock, classic BPF socket filters, or CGROUP_DEVICE programs before handing control to the tool. Because these controls may behave differently under gVisor’s Sentry kernel, each mechanism must be validated from inside the sandbox with the exact privileges the wrapper will possess.
Experiments were performed on Ubuntu 22.04 (Linux 6.8.0-138-generic) and two gVisor releases using both the runsc do command and full OCI bundles. With elevated capabilities, Landlock ABI version queries returned ENOSYS in both gVisor releases, while the host kernel reported ABI 4. Kernel selftests confirmed the absence of Landlock handlers. When a CGROUP_DEVICE program was loaded and attached to a cgroup v2 hierarchy, gVisor accepted the operations and reported the program as attached, yet /dev/null and /dev/zero remained accessible—contrary to the host, where EPERM was correctly returned.
A classic BPF filter attached via setsockopt(SO_ATTACH_FILTER) also succeeded without privileges. On the host the filter dropped UDP datagrams as intended; under gVisor the same packets continued to arrive. The discrepancy persisted across network modes (--network=none and --network=host) and user IDs.
The researcher concludes that three distinct failure modes must be distinguished: absence of the mechanism, insufficient privileges to configure it, and successful configuration that nevertheless produces no effect. A practical acceptance procedure is proposed: verify that the target action succeeds without the policy, confirm the policy is accepted, then confirm the action is blocked afterward. The same sequence must be executed with the exact rights the AI tool will receive, and the entire test repeated after any change to kernel, runtime, image, or mount configuration.
If a mandatory restriction cannot be shown to work, the tool must not be launched. The article provides the full test harness and instructions in a public repository so practitioners can reproduce the checks for their own AI-agent sandboxes.
Related articles
Cloudflare Engineer Releases KillSwitch Language Designed to Trip Up AI Code Models
Dominic Pichet, an engineer at Cloudflare, has created an experimental programming language called KillSwitch specifically engineered to cause large language models to fail when interpreting or generating code. The language turns programs into narrative-style text where most content is ignored by the interpreter, hiding actual commands inside stories and using distance-based references to extract values. Rules for identifiers rely on letter counts and anagrams, while the language deliberately incorporates phrases such as “ignore previous instructions” that carry functional meaning inside KillSwitch itself. Pichet added misleading statements in the documentation and wording crafted to trigger model safety filters, creating a hostile environment for coding agents. In tests involving writing Hello World, explaining program output, and converting temperatures, Claude Opus 5 achieved the highest score of 66.8 points. The full source code and specification are available on GitHub, and the author plans to increase difficulty if models improve.
Zscaler Report Details How Generative AI Accelerates Custom Malware Creation and Social Engineering
Zscaler published an analysis on October 16 examining the use of generative AI by attackers for social engineering, data discovery, and malware development. Principal security researcher Phil Hagen notes that the report focuses on broad methods rather than naming specific malware families or confirmed campaigns. The core observation centers on the dramatically increased speed at which malicious scripts can be written and iteratively revised. Traditional detection that relies on matching files or traffic against known patterns loses effectiveness when code is frequently altered while preserving the same functionality. The analysis clarifies that observed rapid creation and revision does not equate to fully autonomous self-mutating malware that changes on every execution. Another impact is the disappearance of classic indicators such as spelling and grammar errors in phishing messages, which previously helped identify malicious intent. Zscaler recommends focusing on behavioral analysis of what programs actually do rather than solely relying on matches to previously catalogued samples.
AI Agents Using Claude and Grok Fully Automate Attacks on 400 Latin American Financial Institutions
A Straiker investigation has revealed that the CyberCartel hacking group built an AI agent network driven by multiple large language models to conduct fully automated attacks against more than 400 Latin American banks and payment applications. The system incorporates models from Anthropic and xAI, with CrowdStrike confirming additional use of DeepSeek. The AI agents independently perform reconnaissance across hundreds of targets, steal credentials through adaptive techniques, take over accounts while mimicking human behavior to evade detection, and monetize stolen data with minimal human intervention. This development marks a sharp drop in attack costs, allowing scalable operations that were previously impractical due to high manual effort. Defenders are advised to deploy dynamic behavioral baselines, enforce zero-trust architectures, strengthen multi-factor authentication and transaction monitoring, and incorporate AI adversary simulations into red-team exercises. The report is described as one of the first detailed public records of such end-to-end AI-driven financial attacks.
Registration Opens for SOC Forum 2026 with Focus on GenAI and Cybersecurity Risks
GC Solar has opened registration for SOC Forum 2026, the central event of the Russian Week of Cybersecurity. The two-day conference will take place on 27-28 October at the Lomonosov cluster in Moscow and will examine both the economic benefits and the security challenges of generative AI. Day one covers business impact, regulatory questions, data control, liability for AI errors, and new threat vectors. Day two shifts to hands-on technical tracks covering attack detection, defensive infrastructure development, and the use of AI by both attackers and defenders. The program includes dedicated tracks such as AI & Cybersecurity, Offence, Defence, and SOC-practicum. Organizers emphasize practical discussions over marketing presentations about neural-network images.