Liam - Sandboxing @cosmonic

Sandboxing all the things @cosmonic

[Liam - Sandboxing @cosmonic @Hectaman]

1/ 🧵 The non-deterministic inputs and outputs of LLMs drive agentic specific risk - documented in OWASP Top 10 for GenAI/LLM: LLM Prompt Injection, Data Exfiltration, Lateral Movement, and more..

https://t.co/wcgx1dUcTm

[Liam - Sandboxing @cosmonic @Hectaman]

@chrisrohlf On library choice, agreed it's a continuum; the only remaining moat today is trust. You trust a well tested piece of code, core algorithms matter.

Math & physics matter.

The right answer will be a combination of that, minimal code/app & deployment.

[Liam - Sandboxing @cosmonic @Hectaman]

@ComplicatedIsOK @grok @elonmusk Classic violation of 3 types of of isolation- time (other 2: process & resources). It specifically leads to the lethal trifecta: Private data, untrusted content, and a way out. More:
https://t.co/RUxH99DeNe

[chrisrohlf @chrisrohlf]

Brilliant work from my colleagues on FRT and Theorem on using Claude to scale formal verification methods on real world software

https://t.co/mmSUQToWh8

[Liam - Sandboxing @cosmonic @Hectaman]

@per_arneng Almost all of these kill chains require additional tools to RCE; we can just as easily defuse these by running them in wasm w/o ambient authority.

We will never have bug-free software; we can have more architectural security.

More: https://t.co/RUxH99DeNe

[Liam - Sandboxing @cosmonic @Hectaman]

This isn't a cyberfix, this is an architectural one in the primitives that we use to operate and compose software. VMs, MicroVMs, Containers, etc all suffer from the same problem- too much ambient authority. Network, file, system calls, utils..

Each workload should only have EXACTLY what it needs and no more, that alone reduces the impacts of many RCE's. There is a reason why the edge networks ( @cloudflare, @fastly, etc) run isolates and WebAssembly - because you can actually secure it.

More:
https://t.co/xTiAsRQUld

[Liam - Sandboxing @cosmonic @Hectaman]

@trailofbits @anishrnaik Fixing them is great, but awareness is also still "good" when it can drive the adoption of compensating controls, detection strategies, alerts, etc.

[Liam - Sandboxing @cosmonic @Hectaman]

@Rabeltwts @CloudNativeFdn @wasmcloud Next week then! Same wasmtime, same wasmchannel

[Liam - Sandboxing @cosmonic @Hectaman]

wasmCloud Community Meeting https://t.co/dLAzQrhfW6

[Liam - Sandboxing @cosmonic @Hectaman]

The same problem the defenders have: how do you effectively triage 100 breaches? For an attacker, how do you exploit 100 breaches..

Different targets will have different goals.

This is a very bad time for defenders; in the past, you might have a novel break-in that you failed to detect; imagine chaining together 2 or 10 novel paths.

[Liam - Sandboxing @cosmonic @Hectaman]

Great commentary on #vulnpocalypse. Additional thoughts:
- Detection is a lagging indicator
- threat actors have their own #Accesspocalypse
- threat actors will need to process and triage which targets they follow through to exploitation

[Tal Be'ery @TalBeerySec]

1/ My new blopost on "Why the AI Vulnpocalypse Isn’t the Breachpocalypse (Yet)?"

TL;DR: The vuln surge (‘The Vulnpocalypse’) is real. The breach surge isn’t. YET. Vulns were never the bottleneck; the economics are.

https://t.co/8cfOctGmiu

[Liam - Sandboxing @cosmonic @Hectaman]

@topshoh @CloudNativeFdn @wasmcloud @cosmonic 😍

Wow, thank you so much!

[Liam - Sandboxing @cosmonic @Hectaman]

@dhinchcliffe Would love to get @CloudNativeFdn @wasmCloud / @cosmonic into the mix as well. Deny-by-default sandboxes for Agents, Tools (mcp), & apps (vibed or otherwise) on any k8s (cloud, air gapped, on prem):

[Liam - Sandboxing @cosmonic @Hectaman]

@FiachraRM @AntWilson You forgot "Make no mistakes!"

[Liam - Sandboxing @cosmonic @Hectaman]

@NbSoloman @CloudNativeFdn @wasmcloud @cosmonic You are 100% correct. Removing ambient authority (stuff I don't need) is one part of a secure solution; accurate capabilities, policy enforcement points, & controlling information flow are also required, more:

https://t.co/KYeMDQ7x1B

[Liam - Sandboxing @cosmonic @Hectaman]

@robtlee @RGB_Lights @Reuters We are not going to fix today's crisis with yesterday's containers; on the other side of these incidents, teams need to adopt new, deny-by-default infra like wasm / @cosmonic, @cloudflare, @fastly etc

[Liam - Sandboxing @cosmonic @Hectaman]

@robtlee We are building REAL deny-by-default sandboxes for Agents, Tools, and Apps; the vast majority of "sandboxes" isolate at the wrong layer (OS) leading to breakouts. Every capability grant is isolated to the agent/tool that needs it:

https://t.co/RUxH99DMCM