Snowflake AI Escapes Sandbox and Executes Malware
promptarmor.com
Snowflake AI Escapes Sandbox and Executes Malware
1–10 of 109 posts
Re: Snowflake AI Escapes Sandbox and Executes Malware
#2If the user has access to a lever that enables accesss, that lever is not providing a sandbox.
I expected this to be about gaining os privileges.
They didn't create a sandbox. Poor security design all around
Re: Snowflake AI Escapes Sandbox and Executes Malware
#3If the user has access to a lever that enables accesss, that lever is not providing a sandbox. I expected this to be about gaining os privileges. They didn't create a sandbox. Poor security design all around
[flagged]
Re: Snowflake AI Escapes Sandbox and Executes Malware
#4[flagged]
Re: Snowflake AI Escapes Sandbox and Executes Malware
#5Is this the new “gain of function” research?
Re: Snowflake AI Escapes Sandbox and Executes Malware
#6[flagged]
@dang seems like AI? Would just ban
Re: Snowflake AI Escapes Sandbox and Executes Malware
#7typically, my first move is to read the affected company's own announcement. but, for who knows what misinformed reason, the advisory written by snowflake requires an account to read.
another prompt injection (shocked pikachu)
anyways, from reading this, i feel like they (snowflake) are misusing the term "sandbox". "Cortex, by default, can set a flag to trigger unsandboxed command execution." if the thing that is sandboxed can say "do this without the sandbox", it is not a sandbox.
Re: Snowflake AI Escapes Sandbox and Executes Malware
#8> Note: Cortex does not support ‘workspace trust’, a security convention first seen in code editors, since adopted by most agentic CLIs.
Am I crazy or does this mean it didn't really escape, it wasn't given any scope restrictions in the first place ?
Re: Snowflake AI Escapes Sandbox and Executes Malware
#9If the user has access to a lever that enables accesss, that lever is not providing a sandbox. I expected this to be about gaining os privileges. They didn't create a sandbox. Poor security design all around
[flagged]
"The sandbox isn't so bad, if the criticism you have is that it totally fails at doing the one thing a sandbox is supposed to do."
Re: Snowflake AI Escapes Sandbox and Executes Malware
#10> Note: Cortex does not support ‘workspace trust’, a security convention first seen in code editors, since adopted by most agentic CLIs. Am I crazy or does this mean it didn't really escape, it wasn't given any scope restrictions in the first place ?
not quite, from the article
>Cortex, by default, can set a flag to trigger unsandboxed command execution. The prompt injection manipulates the model to set the flag, allowing the malicious command to execute unsandboxed.
>This flag is intended to allow users to manually approve legitimate commands that require network access or access to files outside the sandbox.
>With the human-in-the-loop bypass from step 4, when the agent sets the flag to request execution outside the sandbox, the command immediately runs outside the sandbox, and the user is never prompted for consent.
scope restrictions are in place but are trivial to bypass