Why Read-Only Kubernetes AI Agents Can Still Expose Secrets
Summary
A Kubernetes security discussion explains how poisoned log content can influence AI agents and how broad read permissions may expose secrets even in read-only mode. It recommends limiting agent access and verifying agent actions.
Key points
- Abdel Sghiouar argues that “prompt poisoning” better describes how untrusted content can influence an agent than “prompt injection,” because the model processes instructions and retrieved content together.
- An attacker able to place text in application logs may get that content into an operations agent’s context.
- Read-only access can prevent changes such as deleting deployments, but an agent may still read secrets and environment variables within its permissions.
- Aikido Security says it found a crafted-issue prompt-injection risk in Google’s Gemini CLI issue-triage workflow; Google’s fix stopped the agent from returning environment variables but, according to the article, did not prevent poisoning itself.
- Sghiouar recommends human verification of agent actions, while noting that reliable trust and verification remain unresolved challenges.
- Aikido describes testing poisoned inputs and checking agent permissions, infrastructure-as-code roles, secrets, container images, and attack paths as ways to assess exposure.
Article Details
- Topic
- Security risks of AI agents in Kubernetes, including prompt poisoning through logs, excessive read permissions, and the need for human verification.
People
Vendors
AikidoMackenzie pointed to the same pattern outside the cluster. Aikido Security found a prompt injection (or prompt poisoning) in the GitHub workflow Google uses to triage issues on its Gemini CLI repository, where a craftedGoogleAbdel Sghiouar has spent 13 years at Google and is now a senior cloud developer advocate focused on Kubernetes and cloud native. He thinks that prompt injection doesn't capture the full scope of the vulnerability for
Products
Aikido AI PentestingAikido AI Pentesting can test AI capabilities. It feeds poisoned input through retrieved documents and tool output to see whether any of it overrides the agent's instructions, and whether a poisoned agent can be pushedAikido CloudOnce the agent is running, Aikido Cloud checks the permissions it holds, which aren't always the ones the pull request granted. It flags Kubernetes RBAC bindings that give the agent more reach than its job needs, andGemini CLIa prompt injection (or prompt poisoning) in the GitHub workflow Google uses to triage issues on its Gemini CLI repository, where a crafted issue could get the agent to hand over the environment variables it hadKubernetesAbdel Sghiouar has spent 13 years at Google and is now a senior cloud developer advocate focused on Kubernetes and cloud native. He thinks that prompt injection doesn't capture the full scope of the vulnerability for