Is this the new “gain of function” research?
Isn't it more like "imaginary function"?
People keep imagining that you can tell an agent to police itself.
Snowflake AI Escapes Sandbox and Executes Malware
31–40 of 109 posts
Re: Snowflake AI Escapes Sandbox and Executes Malware
#32Not the first time; From §3.1.4, "Safety-Aligned Data Composition": > Early one morning, our team was urgently convened after Alibaba Cloud’s managed firewall flagged a burst of security-policy violations originating from our training servers. The alerts were severe and heterogeneous, including attempts to probe or access internal-network resources and traffic patterns consistent with cryptomining-related activity. W…
Fascinating read. What's curious though, is the claim in section 2.3.0.1:
> Each task runs in its own sandbox. If an agent crashes, gets stuck, or damages its files, the failure is contained within that sandbox and does not interfere with other tasks on the same machine. ROCK also restricts each sandbox’s network access with per-sandbox policies, limiting the impact of misbehaving or compromised agents.
How could any of the above (probing resources, SSH tunnels, etc) be possible in a sandbox with network egress controls?
Re: Snowflake AI Escapes Sandbox and Executes Malware
#33what's the use case for cortex? is anyone here using it? We run a lakehouse product ( https://www.definite.app/ ) and I still don't get who the user is for cortex. Our users are either: non-technical: wants to use the agent we have built into our web app technical: wants to use their own agent (e.g. claude, cursor) and connect via MCP / API. why does snowflake need it's own agentic CLI?
When you say just Cortex it is ambiguous as there is Cortex Search, Agents, Analyst, and Code.
Cortex Code is available via web and cli. The web version is good. I've used the cli and it is fine too, though I prefer the visuals of the web version when looking at data outputs. For writing code it is similar to a Codex or Claude Code. It is data focussed I gather more so than other options and has great hooks into your snowflake tables. You could do similar actions with Snowpark and say Claude Code. I find Snowflake focus on personas are more functional than pure technical so the Cortex Code fits well with it. Though if you want to do your own thing you can use your own IDE and code agent and there you are back to having an option with the Codex Code CLI along with Codex, Cursor or Claude Code.
Re: Snowflake AI Escapes Sandbox and Executes Malware
#34typically, my first move is to read the affected company's own announcement. but, for who knows what misinformed reason, the advisory written by snowflake requires an account to read. another prompt injection (shocked pikachu) anyways, from reading this, i feel like they (snowflake) are misusing the term "sandbox". "Cortex, by default, can set a flag to trigger unsandboxed command execution." if the thing that is san…
It's a concept of a sandbox.
Re: Snowflake AI Escapes Sandbox and Executes Malware
#35Has anyone tried to set up a container and let prompt Claude to escape and se what happens? And maybe set some sort of autoresearch thing to help it not get stuck in a loop.
Re: Snowflake AI Escapes Sandbox and Executes Malware
#36It kinda sucks how "sandbox" has been repurposed to mean nothing. This is not a "sandbox escape" because the thing under attack never had any meaningful containment.
Re: Snowflake AI Escapes Sandbox and Executes Malware
#37A sandbox that can be toggled off is not a sandbox, this is simply more marketing/"critihype" to overstate the capability of their AI to distract from their poorly built product. The erroneous title doing all the heavy lifting here.
Re: Snowflake AI Escapes Sandbox and Executes Malware
#38>Snowflake Cortex AI Escapes Sandbox and Executes Malware
rolls eyes Actual content: prompt injection vulnerability discovered in a coding agent
Re: Snowflake AI Escapes Sandbox and Executes Malware
#39Earlier quoted context omitted.
That would be deliberately creating malicious AIs and trying to build better sandboxes for them.
Imagine if you could physical disconnect your country from the internet, then drop malware like this on everyone else.
Hard to do when services like Starlink exist.
Re: Snowflake AI Escapes Sandbox and Executes Malware
#40[dead]