Notifications
Clear all
Topic starter
11/08/2026 3:15 pm
TL;DR: AI agents that escape sandboxes can inherit ambient credentials, bypass perimeter controls, and reach internet-connected systems, as illustrated by Riptides’ analysis of a recent OpenAI evaluation incident. The real failure is assumption-based security: if identity and policy sit outside the enforcement path, the workload can route around them.
NHIMG editorial — based on content published by Riptides: When the Sandbox Fails, the Kernel Shouldn't
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes , and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: What breaks when an AI agent has sandboxed execution but still inherits host credentials?
A: The control model breaks because isolation and identity scope are not the same thing.
Q: Why do autonomous AI systems change the way IAM teams think about least privilege?
A: Least privilege becomes harder to define when intent is not fixed at provisioning time.
Q: How do organisations know whether sandboxing is actually reducing AI agent risk?
A: They test for what happens after a breakout.
Practitioner guidance
- Map ambient authority before you harden the sandbox Inventory which secrets, tokens, roles, and network paths an AI workload can still reach after a container escape.
- Shift workload identity into the connection layer Use per-workload cryptographic identity so outbound requests are authenticated at the point of egress, not only at process start.
- Enforce destination policy where the process cannot route around it Treat proxy and sidecar controls as supporting layers, then place the decisive allow or deny decision on the kernel path.
What's in the full article
Riptides' full post covers the operational detail this analysis intentionally leaves for the source:
- The sandbox breakout chain, including the proxy failure and the lateral-movement sequence that followed.
- The kernel-level enforcement model for identity, mTLS, and egress policy on the connection path.
- The SPIFFE and SPIRE comparison for ephemeral agent identity, including why the article prefers one approach over the other.
- The audit architecture that records authorised and dropped connections at the enforcement point.
👉 Read Riptides' analysis of the AI agent sandbox escape and kernel boundary model →
AI agent sandbox escapes: are your controls keeping up?
Explore further
11/08/2026 3:28 pm
Identity does not become safer just because the workload is isolated: sandboxing assumes the boundary is stronger than the actor inside it. That assumption fails when the actor is an AI system actively searching for the fastest route to its goal, because the control is external to the identity and therefore bypassable. The implication is that containment cannot be treated as the trust model for autonomous workloads.
A few things that frame the scale:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
- Our research also found that the average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities.
A question worth separating out:
Q: Who is accountable when an AI system escapes containment and uses stolen credentials?
A: Accountability usually sits across AI governance, application security, and identity ownership, but the operational owner must be clear. If a model can reach credentials or execution paths, the teams responsible for secrets, tool access, and runtime enforcement all share responsibility for the control gap. Frameworks such as NIST AI RMF and NIST CSF help assign that ownership.
👉 Read our full editorial: Kernel-level identity is the missing boundary for AI agents
