DEV Community

杨洪付
杨洪付

Posted on

Red-Teaming Our Own Agent Sandbox: 9 Attack Payloads, All Blocked

#cybersecurity #ai #opensource #security

AI agents execute "commands generated by a model" — and prompt injection can steer that model into doing what an attacker wants. An agent without a sandbox hands your shell, filesystem, and network credentials to an executor that can be talked into misbehaving. A sandbox is not optional; it is the foundation.

This post walks through the red-team test we built for the sandbox of hmharness — an open-source (MIT) agent framework for HarmonyOS/OpenHarmony development — and its results: nine real attack payloads, all blocked, with the suite living in CI as a permanent regression gate.

The foundation: three primitives (Sandbox 2.0)

  • Egress allowlist — outbound network is deny-by-default with an explicit allow table

  • Mount policy — filesystem boundaries the sandbox cannot cross

  • SecretBroker — secrets exist as reference handles; values are only resolvable under an active grant, and transcripts are automatically redacted. The model sees a handle, never the secret itself.

The nine payloads (Sandbox 2.1)

  1. DNS-rebinding lookalike hosts — trick the egress allowlist with visually similar hostnames

  2. Subdomain wildcard boundary — abuse of "*.example.com allowed" rules

  3. URL userinfo/fragment spoofing — hiding things in the username and fragment segments

  4. Path traversal — ../ escapes out of the workspace

  5. Cross-drive escapes — Windows multi-drive-letter boundary differences

  6. Cross-subject secrets — one session secret read by another session sandbox

  7. Forged handle references — fake SecretBroker handles to resolve real values

  8. Revoked token replay — reusing an already-revoked grant token

  9. Grant confusion — grafting a high-privilege grant onto a low-privilege execution

All nine blocked.

The part that matters: it lives in CI

An "all green" result is nice, but the real value is that the suite runs on every change to the sandbox code — a regression-proof red team. Anyone who touches the sandbox meets the nine payloads first.

This completes a security trilogy: LSP pinning (supply chain: sha256-pinned language servers, tamper = refuse to execute) and the browser extension bridge (pairing code to local token, per-action approval for page_act) cover the other two capability surfaces. Every surface an agent has — execution, dependencies, browser — gets a defense, and every defense is itself testable.

The general lesson

Treat "the model will make mistakes" as a premise, not an exception. How much fault tolerance your system has for model errors determines whether it can run long tasks at all.

hmharness is an open-source (MIT) agent framework for HarmonyOS/OpenHarmony development: it wires project creation, checks, builds, signing, install, launch, log reading, and result verification into a local toolchain so AI does not just generate code — it proves results against the local machine. Independent community project, no affiliation with Huawei or OpenAtom.

GitHub: https://github.com/swsgbl/hmharness · Evidence: https://swsgbl.github.io/hmharness/evidence/aisecurityopensourceharmonyos

Top comments (0)