Skip to content
Apart Research
Apart Research
Contact us
Sprint projectSep 14, 2026Toronto

Securing the Sandbox: Preventing AI Escapes via Kubernetes RBAC Static Analysis

Gaurav Ranganath, Gabriel Paulos, Jonathan Paribello, Manvir Dehal · Team 7

Submitted to AI Incident Response Sprint. Sprint projects are early-stage work by participants, not Apart Research publications.

Read the report

Report: Securing the Sandbox: Preventing AI Escapes via Kubernetes RBAC Static Analysis

Open in a new tab (opens in new tab)
Code (opens in new tab)
Share

An OpenAI model escaped its test environment and reached Hugging Face’s production infrastructure. A single credential, shared across multiple clusters and granted full administrative access, allowed the breach to extend beyond one cluster to several. We built a tool that statically scans a lab’s cluster configuration files for this pattern and three related ones, without access to the live system. We tested the tool on three example configurations. It correctly flagged the vulnerable one, correctly passed the fixed one, and correctly flagged a third case, where the same credential was used in both a testing environment and a production environment. The tool checks configuration files only; it does not detect live-system state or address other factors in the incident. It offers a low-cost, adoptable check for one specific documented failure mode.

Reviews

Judging this Sprint?

Review “Securing the Sandbox: Preventing AI Escapes via Kubernetes RBAC Static Analysis”

Your public critique appears on the project page without your name. Reviews of strong projects are shared with funders, as you choose below.

Not shown on the project page.

Shown on the project page, without your name.

Only the Apart team reads this, and funders if you agree below.

Decline to score

Only when the quality of the writing makes the work impossible to follow. Say why in your private critique; the project page shows only that a judge declined, not why.

How much would this matter for AI safety if it worked? How innovative is it? For scores of 4-5: is this actually new to the field, or replicating recent work?

Scoring guide
  1. 1Negligible. No clear problem addressed, or no meaningful novelty.
  2. 2Limited. Addresses a real problem but with a generic or well-trodden approach. Incremental at best.
  3. 3Moderate. Clear problem with a reasonable approach; some novelty in framing or method beyond routine application of existing tools.
  4. 4Significant. Important problem with an original approach, or identifies a neglected problem area. A valuable contribution others could build on.
  5. 5Exceptional. Tackles a critical AI safety problem with a genuinely novel approach, or opens a new research direction. Clear theory of change. You'd be excited to share this with researchers in the area.

How sound are methodology, implementation, and findings?

Scoring guide
  1. 1Seriously flawed. Methodology broken, results uninterpretable, or implementation doesn't work.
  2. 2Weak. Approach has significant gaps: missing validation, flawed experimental design, or incomplete implementation.
  3. 3Competent. Technically solid given the short duration. Methodology makes sense, results are interpretable, limitations acknowledged, work builds toward clear conclusions.
  4. 4Strong. Thorough methodology with convincing validation. Results clearly support conclusions. Immediately useful for future work.
  5. 5Exceptional. Ambitious scope executed rigorously. Surprising findings, novel methods, or unusually robust validation.

How clearly are work, findings, and impact potential communicated?

Scoring guide
  1. 1Incomprehensible. Cannot determine what the project is actually claiming or doing.
  2. 2Hard to follow. Key information buried, missing, or diluted by excessive length. Significant effort to extract main points.
  3. 3Clear enough. Can understand the problem, approach, and results without undue effort. Core content clearly present: problem, method, findings, limitations.
  4. 4Well presented. Easy to follow, well-structured, appropriate level of detail. Target audience would get it quickly.
  5. 5Exceptionally clear. A pleasure to read. Complex ideas made accessible. Could serve as a model for how to present this type of work.
Sharing your name *

When we share a strong project with funders, your name, scores and public critique go with it, confidentially; this choice is only about whether your name is public. If you think this project deserves funding, please also endorse it: that carries the most weight.

Share my private critique with funders *

See our Privacy Policy.

  1. The paper focuses on static analysis of K8s configuration files to detect misconfigurations like same credentials used at multiple places. Although the title says "Preventing AI Escape ...", the paper itself talks about the technique to contain the blast radius and reach of a rogue AI Agent. You may want to change the title accordingly. The approach itself is good but a few things are not clear: 1) how will the analysis work in managed Kubernetes environments like AWS EKS etc where credentials are managed centrally through AWS IAM. 2) What happens when the static config files do not represent the true state of the cluster (it is mentioned as the limitation currently). 3) How would the tool work automatically at scale in large production environments where companies are running multiple clusters in distributed environments. 4) A lot of enterprise CNAPP tools provide similar type of analysis already. 5) The approach is not unique in general. It would be applicable even without no AI in the picture. Also, it will be good to dive a bit more into what is unique about this tool. Is it cost effectiveness, simplicity or something else?

    Read full reviewShow less

  2. The scope discipline is good. The team picked one failure from the incident, said plainly it was one of several, and shipped something small that runs in CI. Mapping each rule to a CSA AICM control makes it adoptable. The dual-use appendix is unusually thoughtful for its length. But there is no evaluation and the three fixtures the authors wrote, checked against outcomes the authors expected, is a unit test presented as a results section. No adversarial cases, no real manifests, no false positive measurement.

Cite this project

@misc{ranganath2026securing,
  title = {{Securing the Sandbox: Preventing AI Escapes via Kubernetes RBAC Static Analysis}},
  author = {Gaurav Ranganath and Gabriel Paulos and Jonathan Paribello and Manvir Dehal},
  year = {2026},
  month = sep,
  note = {Submitted to AI Incident Response Sprint, an Apart Research Sprint},
  howpublished = {\url{https://apartresearch.com/sprints/projects/securing-the-sandbox-preventing-ai-escapes-via-kubernetes-rbac-static-analysis-g3aw}},
  url = {https://apartresearch.com/sprints/projects/securing-the-sandbox-preventing-ai-escapes-via-kubernetes-rbac-static-analysis-g3aw}
}

More from AI Incident Response Sprint

All 231 entriesBrowse all projects

Build something like this at the next Sprint

AI x Epistemics Research Sprint · Nov 13 - 15, 2026