Weird Machine Compositors: Exploiting AI Orchestration at the Expression Layer
Paper shows n8n expression sandboxes can be bypassed, citing three CVEs including two CVSS 9.4 flaws.
The paper argues that enumerate-and-block expression sandboxes in orchestration platforms are unfixable weird machines, comparing them with deprecated Java SecurityManager and vm2 controls. Authors report three escalating bypass rounds against n8n's expression sandbox, covering three CVEs, two scored CVSS 9.4, including one unauthenticated issue. They describe trust laundering, in which pipeline transformations promote attacker-controlled input into credentialed actions, and say AI-assisted enumeration speeds discovery of coverage gaps. They release an AST coverage tool and recommend allowlists over blocklists. No CVE identifiers or in-the-wild exploitation are stated.
- Three n8n sandbox CVEs include two CVSS 9.4 scores and one unauthenticated issue.
- Authors say blocklist expression sandboxes follow the failed path of SecurityManager and vm2.
- Trust laundering moves attacker input to credentialed actions while stripping taint.
- Recommended mitigation is allowlisting rather than enumerating blocked properties.
Full article172 words · extracted from arxiv.org · click to collapse
Orchestration platforms secure user-provided expressions through enumerate and block sandboxing: AST rewriting, runtime property blocklists, template sandbox environments. We demonstrate that these sandboxes are weird machines whose instruction set is the underlying language specification, and that the enumerate and block approach is unfixable, following the same trajectory that led to the deprecation of past sandboxing technologies such as Java's SecurityManager and vm2. We validate this claim through three rounds of escalating bypasses against n8n's expression sandbox (three CVEs, two CVSS 9.4, one unauthenticated), and frame these findings within a broader pattern of sandbox failures across the orchestration products category. We identify a trust laundering pattern where orchestration pipelines and applications move attacker controlled input from untrusted to fully credentialed through transformations that strip taint at each level. AI-assisted enumeration accelerates the discovery of these coverage gaps, compressing the timeline between a sandbox's deployment and its compromise. We provide an AST coverage analysis methodology, an accompanying open-source tool, and a defensive playbook that includes policy inversion (allowlist over blocklist) as a structural mitigation.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.33413