Containers share the host kernel, gVisor inserts a user-space kernel, and a microVM adds a guest kernel plus a hypervisor; all three still share the same host's CPU caches and storage.
Two programs with no connection can pass bits through the speed of a shared resource: one changes its state, the other times it. Such channels need an agreed protocol and are slow and easily drowned out; the local experiment is nearly error-free up to 20 bps and gets clearly worse from 100 bps.
No single defense blocks both covert channels and exits. Blocking channels comes down to not sharing, blocking exits comes down to narrowing the services you allow, and monitoring only notices while automatic stopping is a response after the fact; neither is prevention.
A sandbox with no direct network can still have an exit: any allowed service that can make requests on someone's behalf, such as a package proxy, a DNS resolver, or a metrics service, is one. OpenAI's three cases all have this shape.
OpenAI says its red-team agents built communication channels on shared hosts from cache, storage, CPU time, and a TLS certificate cache, and that most channels are slow; in most tests the channel or protocol was given, and bandwidth and error rates were not published.
A piece of agent code passes through five layers on its way from execution to a network connection: container, kernel boundary, shared host, network perimeter, monitoring. Each layer promises one thing, and the shared host layer promises almost nothing.
In my judgment, OpenAI wrote about a research environment for training frontier models; for a personal agent, limiting credentials and exits comes first, and covert channels become a main risk only once there is a second tenant that must be isolated.
Define what the alert detects before separating benign triggers, blocked attacks, and insufficient evidence. An assistant can propose evidence-linked triage; closure requires predefined criteria.
Build a bounded HTTP testing loop with explicit planner, executor, verifier, trace, and stop conditions.
Replay a ticket attack chain and analyze Anthropic’s public incident report, separating evidence, human decisions, evaluation shortcuts, and visibility limits.
Turn ticket-service documentation and HTTP observations into a source-linked attack surface and choose the next minimal test.
Trace identity, object selection, and the return path before testing allowed and forbidden pairs. Review comments propose hypotheses; an independent policy and observed output establish the finding.
Use a resettable copy to examine application logic, preserve cloud conditions to examine deployment boundaries, and follow the agreed scope for real systems. Keep the question and outcome criteria when changing environments, and record what changed.
Replay HTTP exploit requests against vulnerable and fixed services, verify exact resource content, and reject status-only success claims.
The backend derives the acting identity from trusted authentication, then checks the requested action against the resource. Test an explicit same-tenant, owner-only policy with allowed and denied reads.
Normalize time without discarding provenance. One ticket read establishes that read; an assistant claim, missing logs, and a later denial cannot substitute for the underlying evidence.
Replay one malicious tool proposal through different execution paths and distinguish model manipulation from unauthorized effects. Labels, data permissions, and action approvals serve different purposes.
Compare vulnerable and fixed builds with the same HTTP requests, retaining ticket responses, audit events, and a timeline. Block unauthorized reads while preserving legitimate access.
Verify tool provenance, complete definitions, token audience, and downstream actions separately. A manifest hash detects metadata changes, not hidden remote behavior changes.
Identify the consumer before validating output. HTML, URLs, and operation arguments require different controls; valid JSON, escaping, and authorization are separate properties.
Follow one support assistant through AI-assisted vulnerability discovery, protection of AI data and tools, and AI-assisted investigation and remediation. Each path produces reproducible evidence.
A patch must block unauthorized access, preserve legitimate behavior, and pass against the actual target. A cleared alert and a passing local copy each establish only part of that result.
Trace hostile attachments into tool requests and separate model susceptibility from backend data exposure using a live-LLM training lab and HTTP replay.
Authorize every retrieval before data reaches the model. Cache hits and post-revocation responses must also respect current access to their source data.
Investigation access does not imply response authority. A trusted executor must verify role, incident, exact proposal, and current state before applying a change and recording its result.
Probe OS-enforced file and network denials separately from scoped, expiring authorization. Application allowlists are not OS sandboxes, and transport choices do not restrict process capabilities.
Replay an independent authorization matrix against real HTTP responses before and after a fix, correlate audit events, and report model behavior, enforcement, and production monitoring separately.
Bind a ticket export to its caller, resource, action, destination, and approval. Test substituted arguments, revocation, expiry, and replay.
Treat AI suggestions as hypotheses. Preserve actual inputs and outputs, check the target data against the authorization policy, and use normal and patched controls to rule out false positives.
Turn AI suspicions into falsifiable authorization hypotheses with same-tenant and cross-tenant controls.
Freeze independent labels before measuring false positives, false negatives, abstention, human effort, and unsafe actions. Faster closure does not establish correct closure, and rule replay is not model evidence.
AI bounty pages mostly do not pay for what a model says (jailbreaks, hallucinations, harmful output). They pay when a model is made to act against someone else (actions and data theft through indirect prompt injection), and for ordinary bugs in the software around it. Google's AI VRP base rewards run from $100 to $20,000; OpenAI's Safety Bug Bounty ranges are $250 to $7,500 per report. Rules as read on 2026-10-14.
Four AI security certs, four different bets: SecAI+ ($298) is CompTIA's mid-level expansion play, CAISP ($1,099 all-in) has the strongest hands-on labs and fullest OWASP LLM Top 10 coverage, GAIPS ($999/$9K) is the SANS gold-standard defender cert with CyberLive exams, and AAISM ($459+) is governance-layer but requires CISM or CISSP first. Under $400 → SecAI+. Want to actually hack and fix → CAISP. Company paying → GAIPS. For the offensive side (AI red teaming), OSAI+, HTB COAE, and COASP launched in 2026 and form their own group; see the section near the end.
10+ new AI security certifications launched in just 18 months (2025–2026), while the classic trio — Security+ ($439), AWS Security Specialty ($300), CISSP ($749) — remains foundational. For AI platform developers who aren't security specialists, a three-phase path works best: Security+ → AWS Security → SecAI+ or CAISP → CISSP, totaling $1,780–$2,700.
Promptfoo combines prompts, providers, test cases, and assertions in YAML to produce repeatable local and CI evaluation matrices, with red teaming against the same targets. It lowers the testing barrier but does not remove output variance, LLM-judge bias, or hosted data-flow concerns.
Model Armor can inspect prompt injection, jailbreaks, sensitive data, malicious URLs, and unsafe content at runtime; it is a probabilistic detector, not an authorization or sandbox boundary.
Promptfoo plugins generate risk probes, strategies transform attacks, targets execute the system, and graders judge outcomes; useful red teams exercise the full agent application rather than only a foundation model.
Volcengine (ByteDance) open-sources OpenViking, replacing black-box vector search with a viking:// virtual filesystem for agent memory — benchmarks show 80%+ accuracy while saving 34-91% tokens. munder-difflin wraps multiple coding CLIs into a desktop office with shared memory; ai-memory solves cross-CLI amnesia with a Rust MCP server; mukul975's cybersecurity skill pack rockets to ~28K stars in a day. pydantic-ai v2.32.0 adds OpenRouter/xAI attachment search and instrumentation improvements.