A sandbox for untrusted AI code held up on escapes, but DNS still leaked data
Ok_Beyond_6313 · reddit · 2026-07-28
I red-teamed a sandbox used to run untrusted AI-generated code and found that almost every escape and secret-leak path was blocked: no root, no capabilities, gVisor in place, read-only filesystem, blocked host paths, no service-account token, no metadata access, and deny-all egress to internal and external IPs.
The one leak was DNS. Even with TCP traffic locked behind a proxy allowlist, pods could still reach CoreDNS over UDP/TCP 53, which forwarded external lookups upstream. That creates a covert exfiltration channel via DNS labels. The fix was a locked-down resolver that only answers cluster.local and returns NXDOMAIN for everything else, with DNS egress permitted only to that resolver. Package installs still work because the proxy resolves allowed hosts itself. The author is also unsure whether allowing github/pypi/npm downloads is itself too permissive for agent sandboxes.
Related event: DNS Identified as Key Exfiltration Vector in AI Code Sandboxes(2 posts)→
More from coding & agent
- Startup playbook says to ship an MVP with Claude Code, charge on day one, and automate marketing — sahilypatel · 2026-07-28
- MinerU turns PDFs and Office docs into LLM-ready Markdown to cut token costs — lxfater · 2026-07-28
- Builder’s job is orchestration, not handing judgment to the model — cornmacabre · 2026-07-28
- Open-source code review agents are now running inside GitHub Actions — Silly_Entertainer92 · 2026-07-28
- Do panel-of-judges code reviewers still matter as agent models improve? — NeighborhoodOwn8510 · 2026-07-28
- Matt Pocock turns his skills into a Claude Code plugin with one-command install — mattpocockuk · 2026-07-28