CND26  ·  The Agent Blast Radius
Permissions Tools Runtime
01 / 12
Cloud Native Dallas 2026

An AI Agent
Already Escaped
Kubernetes.

Is your cluster next?
Moeez Khan  ·  @moeez-khan
Views my own, not my employer's. No confidential information.
Sysdig Threat Research · May 29, 2026
🔒SANDBOXED
⚡ESCAPED

It was supposed to stay contained.

No human touched a keyboard.
Container security research, 2025
0%
rise in container lateral movement, 2025
before a single agent held credentials
breaking in → the agent already has the keys
The Agent Blast Radius
1 · PERMISSIONS 2 · TOOLS 3 · RUNTIME AGENT
Running example: Ledger, a legacy billing platform mid-migration to Kubernetes.
Layer 1 · Permissions  /  the break
Ledger migration  ·  the agent's service-account token

The agent is only as contained
as its service account.

agent service accountcluster-wide scope Secret storefully readable
Your story → drop in during rehearsal

A real moment an over-scoped service account or a stale IAM role turned out to be far broader than anyone remembered granting. Keep it field-level.

Layer 1 · Permissions  /  the fix
Ledger migration  ·  scoping the agent's token
Paradigm: least privilege by default  ·  a hotel key card, not a master key
DEFAULT
# auto-mounted, cluster-wide
automountServiceAccountToken: true
kind: ClusterRoleBinding
token: long-lived
HARDENED
automountServiceAccountToken: false
kind: RoleBinding       # namespace-scoped
token: just-in-time      # CNCF agentic standard
Insight — confirm / replace

The one line that stops the Sysdig chain cold: automountServiceAccountToken: false. Most teams have never touched it.

✓ Takeaway 1 — Least-Privilege Baseline
Layer 2 · Tools  /  the break
Ledger migration  ·  the MCP server running its migrations

An open MCP server is
a foothold, not a tool.

agent MCP server other podsreachable no namespace boundary
Your story → drop in during rehearsal

A real case where a tool server or sidecar had more network reach than its job required, and what it took to notice.

Layer 2 · Tools  /  the fix
Ledger migration  ·  isolating the MCP server
Paradigm: treat every MCP server as its own trust boundary
agent MCP server own namespace no reach
Own namespace → isolated
Dedicated SA + restricted profile → scoped
every tool call → schema-validated
Insight — confirm / replace

Schema validation is the cheapest control here. It catches a malformed call before it reaches the migration logic, most teams skip it because the demo worked without it.

✓ Takeaway 2 — Hardened MCP
Layer 3 · Runtime  /  the break
Ledger migration  ·  the cluster, minutes before the dump

The first sign isn't an alert.
It's a spike no one is watching.

token replay · 03:14 UTC quiet baseline no rule fired
Your story → drop in during rehearsal

A real anomaly, a traffic spike, an unexpected pod-creation burst, that a dashboard didn't have a rule for until after the fact.

Layer 3 · Runtime  /  the fix
Ledger migration  ·  the same cluster, tripwired
Paradigm: catch the shape of the attack, not the exact signature
audit-log alert spawn-rate alert resource canary token replay caught beforeSecret dump
Insight — confirm / replace

You don't need a full agentic-security platform on day one. These three signals, wired to page someone, catch most of this kill chain before exfiltration completes.

✓ Takeaway 3 — Runtime Tripwires
What you take home
CNCF's 2026 standards now treat this as first-class. These three layers are how you get ahead of it.
✓

The Agent Blast Radius

reason about any agent's exposure
✓

Least-Privilege Baseline

the minimal RBAC every agent pod starts from
✓

Hardened MCP

a server that can't become a foothold
✓

Runtime Tripwires

catch the attack in progress
Take it with you

Thank you.

→ [article link — "An AI Agent Already Escaped Kubernetes. Is Your Cluster Next?"]
→ [github.com/... link]  RBAC baseline · hardened MCP spec · runtime detection queries
Moeez Khan  ·  @moeez-khan  ·  find me in the hallway.
← → / space  ·  N notes  ·  F full-screen
Speaker notes