Image: cdn.prod.website-files.com · rights & removal

AI agent security in Kubernetes: Why prompt injection isn't the right term

Reporting by Aikido Security ResearchRead the original at aikido.dev

Executive Summary

AI agents operating within cluster environments introduce specific security risks centered on access permissions and prompt handling. An agent often receives broad read access, typically through Role-Based Access Control (RBAC), which creates a vulnerability for potential misuse. Attackers can leverage this access in two primary ways: poisoning the input data the agent reads via application logs (prompt poisoning) or exploiting overly permissive read access to exfiltrate sensitive information like secrets and environment variables if the agent is instructed incorrectly. While limiting an agent to read-only mode prevents destructive actions, it does not prevent the leakage of sensitive data or the ingestion of poisoned context. The core security consideration shifts from traditional injection attacks to managing the scope of what a reasoning component can perceive and act upon.

Facts Only

* An agent can trace problems across all layers of the stack faster than an on-call engineer.
* Read access is sufficient for an agent to read every secret exposed by the cluster.
* Prompt poisoning involves injecting data into application logs, which the agent then reads.
* Prompt injection is distinct from SQL injection because large language models process system prompts and context simultaneously.
* An agent with over-broad read access can access secrets and environment variables if instructed incorrectly.
* Read-only agents still ingest poisoned log data.
* Aikido Security found prompt injection in the GitHub workflow for the Gemini CLI repository, where an issue could result in the agent handing over environment variables.
* Fixing the leak closed that specific vector but left the potential for poisoning open.
* Agent security requires verifying decisions because language models can hallucinate reasoning.

Full Take

The narrative centers on the control plane shift: moving from static access controls to dynamic agent decision-making. The core tension lies in the gap between the necessary operational requirement of an agent (broad visibility) and the principle of least privilege. Prompt poisoning illustrates that traditional input sanitation techniques are insufficient when the agent's reasoning process itself is the vulnerability; the mechanism shifts from preventing *command execution* to managing *information synthesis*. The focus on "trust but verify" highlights a fundamental challenge in autonomous systems: establishing verifiable boundaries for emergent behavior, especially when relying on probabilistic reasoning. The pattern points toward a systemic vulnerability where control over data flow and instruction context must be extended beyond conventional access controls into the LLM's internal state management. The necessity of tools like Aikido AI Pentesting suggests that testing must account for multi-step chains—where poisoning input feeds into retrieval, which then dictates tool calls—to fully assess reachability across infrastructure boundaries.
Autonomy check: No autonomy signals.

From the original · Aikido Security Research

This post is based on Mackenzie's conversation with Abdel Sghiouar on The Secure Disclosure podcast. Listen to the full episode or watch below.

Read the full story at aikido.dev

Sentinel unavailable

The automated check of the source article's wording did not complete, so no result is shown.

This looks only at the wording of the original source article, not at this page's AI-written sections. A small local AI model made this estimate. It has not been checked against known human and machine texts, so treat it as provisional. It cannot show who wrote an article.