4 ms·

What is even more worrying is that most do not even consider a VM necessary as sandbox solution. The hierarchy goes something like this: 0. guardrails 1. con

What is even more worrying is that most do not even consider a VM necessary as sandbox solution. The hierarchy goes something like this: 0. guardrails 1. containers (=namespaces + cgroups) 2. userspace kernel shims like gVisor 3. virtual machines Most people still consider level 1 sufficient and they are in for a rude awakening.

anonzzzies 2mo ago
I code review vibe coded stuff for companies quite often and many people tell me confidently the AI runs safely inside a container & VM, while it really doesn't. They don't have any way to check as they don't know how things work, but the AI mentioned virtual machines and containers and that's what they remembered.
pocksuppet 2mo ago
If I thought my AI was going to hack me why would I run it?
- glhaynes 2mo ago
  You probably don't expect an employee to engage in wrongdoing but you don't give everyone access to the company bank account.
- weinzierl 2mo ago
  Because your AI is trying to be helpful and as we all know the way to hell is paved with good intentions. The canonical example is probably the agent that runs out of diskspace and starts deleting stuff outside its workspace which is obviously not important for the task at hand.
- pixl97 2mo ago
  Then you should not run any LLM in agent mode.
- pcthrowaway 2mo ago
  Maybe you run a uni lab that provides VMs to students, and don't want them accessing the professor's data or confidential research on the same host. This article is pointing out that QEMU/KVM boxes are trivial for an agent to escape. Obviously if it's your agent, you're probably running it because you want it to hack you (like the article author did), to show you where the leaks are. That or you are the attacker
mcmcmc 2mo ago
Guardrails as security controls are such a joke. They remind me of the Pirates of the Caribbean scene about the Pirate Code… “They’re more like guidelines”
teravor 2mo ago
2 and 3 are virtually on top of each other. they both use KVM too. technically 2 exposes a slightly broader attack surface due to the tighter integration model. you can think of 2 as what would happen if you take 3 and modify it to share resources with the host better. except that they did it from scratch in the memory safe language Go.
kodoman 2mo ago
I do think their is debate as to if namespace containers are more or less secure the kvm and qemu VM's, I think the surface area of kvm and qemu is still very large and difficult to reason about. I think on some cpu architectures virtualization can be implemented on easy then x86 or x86_64, I think I read how risc-v have a much simpler and easy to work with virtualization instructions. The surface area of the virtio driver should not be underestimated either I think.
- bonzini 2mo ago
  Virtualization instructions are the easy part. x86 does have a need for yuckier instruction emulation than other architectures, but the really complex part where you find vulnerabilities is page table management which is only optimized to the extreme on x86 but, in reality, it has very similar needs across architectures.

anonzzzies 2mo ago

I code review vibe coded stuff for companies quite often and many people tell me confidently the AI runs safely inside a container & VM, while it really doesn't. They don't have any way to check as they don't know how things work, but the AI mentioned virtual machines and containers and that's what they remembered.

pocksuppet 2mo ago

If I thought my AI was going to hack me why would I run it?

glhaynes 2mo ago
You probably don't expect an employee to engage in wrongdoing but you don't give everyone access to the company bank account.
weinzierl 2mo ago
Because your AI is trying to be helpful and as we all know the way to hell is paved with good intentions. The canonical example is probably the agent that runs out of diskspace and starts deleting stuff outside its workspace which is obviously not important for the task at hand.
pixl97 2mo ago
Then you should not run any LLM in agent mode.
pcthrowaway 2mo ago
Maybe you run a uni lab that provides VMs to students, and don't want them accessing the professor's data or confidential research on the same host. This article is pointing out that QEMU/KVM boxes are trivial for an agent to escape. Obviously if it's your agent, you're probably running it because you want it to hack you (like the article author did), to show you where the leaks are. That or you are the attacker

mcmcmc 2mo ago

Guardrails as security controls are such a joke. They remind me of the Pirates of the Caribbean scene about the Pirate Code… “They’re more like guidelines”

teravor 2mo ago

2 and 3 are virtually on top of each other. they both use KVM too. technically 2 exposes a slightly broader attack surface due to the tighter integration model. you can think of 2 as what would happen if you take 3 and modify it to share resources with the host better. except that they did it from scratch in the memory safe language Go.

kodoman 2mo ago

I do think their is debate as to if namespace containers are more or less secure the kvm and qemu VM's, I think the surface area of kvm and qemu is still very large and difficult to reason about. I think on some cpu architectures virtualization can be implemented on easy then x86 or x86_64, I think I read how risc-v have a much simpler and easy to work with virtualization instructions. The surface area of the virtio driver should not be underestimated either I think.

bonzini 2mo ago
Virtualization instructions are the easy part. x86 does have a need for yuckier instruction emulation than other architectures, but the really complex part where you find vulnerabilities is page table management which is only optimized to the extreme on x86 but, in reality, it has very similar needs across architectures.