VMs won't contain cyber-capable agents

(blog.trailofbits.com)

60 points | by polyrand 3 hours ago ago

24 comments

  • masterj 40 minutes ago

    Outside of the initial wave of security vulnerabilities and scrambling, it seems like the logical outcome of this over time is likely vastly more secure vm environments?

    • ninininino 6 minutes ago

      We need better digital jailcells for our digital slaves basically.

      Or if you see AI as more tool and less entity, better gunsafes for our guns.

  • amluto 10 minutes ago

    IMO the obvious answer is formally verified security.

    We can do this today for user mode, and we can mostly do it for ARM64 virtualization. It will be a while and would require substantial assistance from Intel or AMD to achieve it for x86 virtualization because the hardware is Too Darn Complicated and Too Poorly Specified.

    Formal verification of the hardware should also be possible.

  • DenisM 10 minutes ago

    I’m guessing the new world will be a small set of VM tech that’s consistently hardened by all labs every day with each new model before model release.

    This won’t make the tech secure, but it will nullify models ability to breakout by making a controlled breakout first. Kinda like controlled forest burn.

  • SirGiggles 38 minutes ago

    The market is smaller (maybe, I'm not sure what the statistics are) but it would be interesting to see how Xen stacks up; also stuff like gVisor or libkrun. The latter is probably implicitly the same as Firecracker given the ancestry of the libraries used.

  • weinzierl 42 minutes ago

    What is even more worrying is that most do not even consider a VM necessary as sandbox solution.

    The hierarchy goes something like this:

    0. guardrails

    1. containers (=namespaces + cgroups)

    2. userspace kernel shims like gVisor

    3. Virtual Machines

    Most people still consider level 1 sufficient and they are in for a rude awakening.

    • anonzzzies 33 minutes ago

      I code review vibe coded stuff for companies quite often and many people tell me confidently the AI runs safely inside a container & VM, while it really doesn't. They don't have any way to check as they don't know how things work, but the AI mentioned virtual machines and containers and that's what they remembered.

    • pocksuppet 10 minutes ago

      If I thought my AI was going to hack me why would I run it?

      • weinzierl 4 minutes ago

        Because your AI is trying to be helpful and as we all know the way to hell is paved with good intentions. The canonical example is probably the agent that runs out of diskspace and starts deleting stuff outside its workspace which is obviously not important for the task at hand.

      • glhaynes 7 minutes ago

        You probably don't expect an employee to engage in wrongdoing but you don't give everyone access to the company bank account.

  • _tk_ 15 minutes ago

    I think this is mostly in line with "all software is now easily exploitable by agents given enough tokens". However, in the long run we should really see software that is more secure than today. I do wonder though how the procedural flaws that exist today - bugs patched upstream, but not in the distro - will be fixed reliably.

  • zzril 10 minutes ago

    Maybe we should treat the agents like coworkers? I don't physically share my machine with my coworkers.

    • esafak a few seconds ago

      Requiring separate machines for each agent is a nonstarter.

  • otterley 15 minutes ago

    ...except when they do:

    "An off-the-shelf VM is not enough to contain a modern, cyber-capable AI agent...us[e] a virtualization technology that was purposely built with a minimal attack surface and a focus on security, like Firecracker. I had the AI agent run against Firecracker. It was able to hardlock the machine due to more Linux kernel flaws (all patched in upstream), but could not successfully escape."

    On Linux, it's all KVM and CPU hardware virtualization under the hood. Looks like the remaining known issues are with userspace. That's not to say more kernel- and hardware-level bugs won't be found, but the same tools that can find escape mechanisms are shields as well as swords.

    • weinzierl 7 minutes ago

      The attack surface Linux offers is gigantic but your agent doesn't need most of it. We can live with an agent not being able to run a 20 year old Oracle version. That is why kernel shims like gVisor are interesting.

  • kodoman an hour ago

    Damn this is scary, I did not realize the extent of agent escape potential. I think I have to re-evaluate my assumptions a about sandboxing agents wow. Made worse by the fact that prompt injection attacks seem very difficult to mitigate besides checking the data and the LLM's getting better at not following malicious prompt injection instructions.

  • wmf 15 minutes ago

    More like QEMU won't contain agents.

  • phendrenad2 7 minutes ago

    [delayed]

  • tamimio 9 minutes ago

    This makes me wonder, can this be extended to micro-segmentations? As unlike traditional segmentation they usually rely on virtual switches and SDN software defined networks coupled with virtual machines and containers. If it does, then it’s game over the impact will go beyond that VM to the whole network.

  • hresvelgr 28 minutes ago

    I'm not worried about these models becoming smarter, I'm worried about them becoming faster. Chat Jimmy is a glimpse of a dark future where models equivalent to Sol and Fable are unleashing hell at >17,000 tokens a second, and the people I talk to are worried about slop...

    • prpl 18 minutes ago

      A SOTA model at 10k will be materially different, even the model is 6 months old.

    • rvz 23 minutes ago

      This is what software engineers put onto themselves. These models will get smarter at the level of Sol, Fable and K3 and faster at the same time at 20,000+ tokens a second.

      After a decade of software engineers disrespecting their own field and automating themselves out of a job and now they're upset because AI models are doing it to them from junior to the staff engineer level? No other field does that except for SWEs.

      In fact, we might as well have faster and smarter AI models and sit back and see what happens.

  • wslh 37 minutes ago

    The capabilities are incredible. I'd love to see even rough metrics on token consumption/cost in addition to the ~12-hour runtime.

    The interesting thing is that this naturally makes you want to isolate the VM as much as possible. But then every remaining interface becomes part of the attack surface: RDP, SSH, even terminal escape sequences, using sounds, and why not social engineering.

  • coyfiber an hour ago

    "I am old and I like stability and consistency" relatable