Containing the Autonomous Operator: A Defense-in-Depth Framework and Reference Architecture for Securing AI Agents on Kubernetes
Framework secures LLM agents on Kubernetes assuming full prompt-injection compromise, mapping seven defense layers to EKS, AKS, and GKE controls.
The paper argues LLM agents operating on Kubernetes must be secured under the assumption the model is fully compromised by prompt injection, collapsing the data/control boundary in cloud-native security. It contributes a ten-class threat taxonomy aligned with OWASP agentic guidance, nine design principles centered on complete mediation at the tool boundary, and a seven-layer defense-in-depth framework using workload identity, RBAC/ValidatingAdmissionPolicy, gVisor/Kata sandboxing, FQDN egress policy, an agent/MCP gateway, and eBPF runtime enforcement. A reference architecture provides concrete policy artifacts for Amazon EKS, Azure Kubernetes Service, and Google Kubernetes Engine. Evaluation is qualitative, with a threat-control coverage matrix and four attack walkthroughs but no measured attack-success or overhead figures.
- Assumes the agent is fully compromised by prompt injection; model is not a boundary
- Ten-class threat taxonomy aligned with OWASP agentic application guidance
- Seven layers include RBAC, gVisor/Kata sandboxing, MCP gateway, eBPF enforcement
- Reference architecture ships policy artifacts for EKS, AKS, and GKE
- No measured attack-success or overhead numbers; residual risks identified
Full article264 words · extracted from arxiv.org · click to collapse
Large language model (LLM) agents are moving from chat interfaces into infrastructure operations, where they read telemetry, call tools, generate and execute code, and change the state of production Kubernetes clusters. This collapses a boundary that conventional cloud-native security assumes: the boundary between data and control. Content that an agent merely reads (a log line, a ticket, a tool description) can redirect what it does. This paper argues that the model must not be treated as a security boundary and that agent safety on Kubernetes is therefore an infrastructure problem: every guarantee must continue to hold under the assumption that the agent is fully compromised by prompt injection. We contribute (i) a threat model and ten-class threat taxonomy for agents operating on and within Kubernetes, aligned with emerging OWASP guidance for agentic applications; (ii) nine design principles, centered on complete mediation at the tool boundary and on breaking the combination of untrusted input, sensitive access, and external egress; (iii) a seven-layer defense-in-depth framework that maps each principle to native or widely adopted Kubernetes mechanisms: workload identity, RBAC and ValidatingAdmissionPolicy, gVisor/Kata sandboxing via the SIG Apps Agent Sandbox project, FQDN-aware egress policy, an agent/MCP gateway with policy-as-code over tool arguments, and eBPF runtime enforcement; (iv) a reference architecture with concrete policy artifacts and per-layer bindings for Amazon EKS, Azure Kubernetes Service, and Google Kubernetes Engine; and (v) a qualitative evaluation comprising a threat-control coverage matrix and four attack walkthroughs, with a proposed empirical methodology. We report no measured attack-success or overhead figures; instead we identify residual risks and the measurements needed to validate the framework.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2610.02861