Andrey Rybka describes incidents involving sandbox escapeAn AI agent sandbox is an isolated execution environment that limits which files, processes, networks, credentials, and external systems an agent can access., stolen credentials and agent-to-agent privilege escalation. He recommends individual agent identities, short-lived scoped credentials and limits on access between agentsAn agent permission boundary defines and enforces which resources and actions an automated agent is allowed to use..
Andrey Rybka discusses malicious instructions hidden in email, marketplace content and agent memoryPrompt injection occurs when untrusted content attempts to redirect an AI system's behaviour beyond the authority of that content.. He proposes separating untrusted data from instructions, tagging provenance and requiring human approval for consequential actions.
Andrey Rybka recommends deterministic checks around tool calls, default-deny outbound traffic including DNS, tenant isolation and circuit breakers. He illustrates the case for controls outside the model with examples including a production database deletion and a poisoned packageSoftware supply chain security protects the dependencies, tools and delivery processes used to build and distribute software, including AI applications..
Watch on YouTube
