Sandboxing Agentic AI With LSM-BPF
summary
Shows that untrusted agent-generated code can perform real attacks (example: LLM-jacking exfiltrating credentials via Plotly and a CNCF demo running nmap), argues probabilistic prompt filters fail, and demonstrates a practical, preemptive sandbox using LSM-BPF bytecode injected at LSM hooks. Uses KubeArmor CRDs to enforce least-privilege per-process file, network and capability rules (LSM-BPF since 2019 and enabled across AWS/GCP/Azure), avoids seccomp’s coarse syscall rules, and reports working demos plus roadmap items like network policies and Windows runtime work.
AI-written summary · about
chapters (12)
- 0:00Securing agentic AI with LSM-BPF
- 1:03Recent AI security incidents
- 3:09Runtime AI security risks
- 7:01Containers and prompt firewalls limits
- 8:48Dashboard use case risks
- 10:13Prompt firewall example and LLM jacking
- 12:41Sandboxing requirements and techniques
- 15:53Why LSM-BPF for agentic AI
- 19:03Qarma project introduction
- 21:11Runtime security for AI models
- 22:55Project roadmap and future
- 23:57Q&A
related talks
07mLightning Talk: Armoring Cloud Native Workloads with BPF LSM
24mRuntime Security: Challenges & Solution Space
39mTrust, but Sandbox: Securing AI Agents in Kubernetes
30mWhy Prompt-Level Guardrails Fail for AI Agents
34mZero Secrets: Building Secure Infrastructure for AI Agents
38mSandboxing in Linux with zero lines of code
28mAgent Runtime Security: Enforce, Attest, Decide
25mPlease Sandbox your AI Agents