Hacker News Reader

Hacker News

Comment by weinzierl | Hacker News Reader

Full thread

weinzierl

What is even more worrying is that most do not even consider a VM necessary as sandbox solution.

The hierarchy goes something like this:

0. guardrails

1. containers (=namespaces + cgroups)

2. userspace kernel shims like gVisor

3. virtual machines

Most people still consider level 1 sufficient and they are in for a rude awakening.

View on HN

I code review vibe coded stuff for companies quite often and many people tell me confidently the AI runs safely inside a container & VM, while it really doesn't. They don't have any way to check as they don't know how things work, but the AI mentioned virtual machines and containers and that's what they remembered.

2 and 3 are virtually on top of each other. they both use KVM too.

technically 2 exposes a slightly broader attack surface due to the tighter integration model.

you can think of 2 as what would happen if you take 3 and modify it to share resources with the host better. except that they did it from scratch in the memory safe language Go.

Guardrails as security controls are such a joke. They remind me of the Pirates of the Caribbean scene about the Pirate Code… “They’re more like guidelines”

I do think their is debate as to if namespace containers are more or less secure the kvm and qemu VM's, I think the surface area of kvm and qemu is still very large and difficult to reason about. I think on some cpu architectures virtualization can be implemented on easy then x86 or x86_64, I think I read how risc-v have a much simpler and easy to work with virtualization instructions.

The surface area of the virtio driver should not be underestimated either I think.

Virtualization instructions are the easy part. x86 does have a need for yuckier instruction emulation than other architectures, but the really complex part where you find vulnerabilities is page table management which is only optimized to the extreme on x86 but, in reality, it has very similar needs across architectures.

If I thought my AI was going to hack me why would I run it?

You probably don't expect an employee to engage in wrongdoing but you don't give everyone access to the company bank account.

Because your AI is trying to be helpful and as we all know the way to hell is paved with good intentions. The canonical example is probably the agent that runs out of diskspace and starts deleting stuff outside its workspace which is obviously not important for the task at hand.

Then you should not run any LLM in agent mode.

Maybe you run a uni lab that provides VMs to students, and don't want them accessing the professor's data or confidential research on the same host.

This article is pointing out that QEMU/KVM boxes are trivial for an agent to escape. Obviously if it's your agent, you're probably running it because you want it to hack you (like the article author did), to show you where the leaks are. That or you are the attacker

Reply on news.ycombinator.com