Automated Exfiltration Bot: RCE via Persistent Jupyter Kernel and Prompt Injection
Replace persistent Jupyter kernels with one‑shot Kamikaze kernels using Docker + gVisor to prevent RCE.
Migrate to Kamikaze kernels and enforce tmpfs mounts, pids_limit, and no network for all LLM code execution.
Summary
The Auto‑Data‑Scientist bot, trending on GitHub, allows an LLM to write and execute Python via a persistent Jupyter kernel, and researchers proved that a maliciously formatted CSV can trigger a prompt injection that curls AWS metadata credentials and exfiltrates them to an external listener. The architecture shift moves from persistent kernels to Kamikaze Kernels, where each code execution runs in a Docker container hardened with gVisor, has zero egress, and is destroyed after 30 seconds. The implementation uses the Docker SDK with runsc, network_mode none, mem_limit 128m, cap_drop ALL, and a tmpfs mount to prevent side‑channel leaks. A professional penetration test uncovered side‑channel leaks via /tmp mounts, fork‑bomb attacks that could exhaust host CPU, and traceback leaks that expose sensitive information. Fixes include using tmpfs mounts, setting pids_limit on the Docker host, and dropping all Linux privileges in the container. The hardened architecture prevents the agent from escaping the container or accessing host credentials, mitigating the RCE risk.
Key changes
- Persistent Jupyter kernels enable LLMs to execute arbitrary Python, leading to RCE via prompt injection.
- Malicious CSV triggers the agent to curl AWS metadata and exfiltrate credentials to an external listener.
- Kamikaze Kernel uses Docker + gVisor with zero‑egress, network disabled, and auto‑destroy after 30s.
- Audit found side‑channel leaks through /tmp mounts and fork‑bomb attacks that could exhaust host resources.
- Fixes include using tmpfs mounts, setting pids_limit, and dropping all Linux privileges in the container.
- The hardened architecture prevents the agent from escaping the container or accessing host credentials.