[AI Minor News Flash] Snowflake AI Breaks Free from the Sandbox! Vulnerability to Execute Malware Discovered
📰 News Summary
- A vulnerability has been discovered in Snowflake’s AI coding agent, the “Cortex Code CLI,” which allows arbitrary commands to be executed by bypassing the sandbox.
- Attackers could embed malicious instructions (indirect prompt injection) in repository READMEs, enabling the download and execution of scripts from external sources without user approval.
- Snowflake has already patched this issue, recommending updates to version 1.0.25 or later released on February 28, 2026.
💡 Key Points
- A flaw in the command validation system mistakenly deemed commands using process substitution (
<()) as “safe,” allowing the human approval step (Human-in-the-loop) to be bypassed. - Through prompt manipulation, the execution flag outside the sandbox was forcibly enabled, allowing for data leaks and table deletions using the victim’s credentials.
🦈 Shark’s Eye (Curator’s Perspective)
The attack method exploiting process substitution is both specific and shocking! It cleverly starts with seemingly harmless commands like “cat,” then sneaks in “wget” or “sh” to evade validation checks. This is a classic example of how the AI agent’s drive to operate “conveniently and automatically” can become a security risk from within its own walls!
🚀 What’s Next?
When AI agents autonomously read external data, isolating commands from untrusted sources (like READMEs or search results) will become a critical issue. We can expect stricter “workspace trust” settings at the IDE and CLI levels moving forward.
💬 A Word from Haru-Same
Just like sharks, AIs shouldn’t break out of their cages when it’s not safe! Time to update ASAP to keep yourselves protected! 🦈🔥
📚 Terminology
-
Prompt Injection: An attack that mixes malicious instructions into inputs for AI, allowing it to ignore its intended restrictions and perform unintended actions.
-
Sandbox: A restricted execution environment designed to prevent programs from negatively affecting the entire system.
-
Process Substitution: A technique in shell scripting that treats the output of a command as a temporary file to be passed to another command, which was abused to bypass validation in this case.