Kubernetes agent defenses and risky built-in RBAC grants

An arXiv framework hardens LLM agents on Kubernetes; Datadog found over 3,500 dangerous RBAC grants to built-in principals.

Two separate Kubernetes security reports appeared within days of each other and do not disagree on shared facts. An arXiv paper dated 2026-10-02 argues that LLM agents on Kubernetes should be secured under the assumption of full prompt-injection compromise, collapsing the data/control boundary. It offers a ten-class threat taxonomy aligned with OWASP agentic guidance, nine design principles, and a seven-layer defense-in-depth stack (workload identity, RBAC/ValidatingAdmissionPolicy, gVisor/Kata sandboxing, FQDN egress policy, an agent/MCP gateway, and eBPF), plus policy artifacts for EKS, AKS, and GKE. That evaluation is qualitative only, with no attack-success or overhead measurements. Separately, Datadog Security Labs reported on 2026-10-05 that, across more than 65,000 clusters from nearly 10,000 organizations, more than 3,500 bindings still granted at least one dangerous permission to system:anonymous, system:unauthenticated, or system:authenticated after defaults and obsolete PodSecurityPolicy objects (removed in Kubernetes 1.25) were excluded from more than 320,000 such bindings, leaving about 44,000. Datadog also says EKS and GKE limit anonymous endpoints, AKS disables anonymous auth, and GKE's system:authenticated default is unusually broad.

• An arXiv cs.CR paper dated 2026-10-02 proposes a defense-in-depth framework for LLM agents on Kubernetes that assumes the model is fully compromised by prompt injection and is not a security boundary.
• The paper contributes a ten-class threat taxonomy aligned with OWASP agentic guidance, nine design principles centered on complete mediation at the tool boundary, and a seven-layer framework using workload identity,…
• Its reference architecture includes concrete policy artifacts for Amazon EKS, Azure Kubernetes Service, and Google Kubernetes Engine; evaluation is qualitative (a threat-control coverage matrix and four attack walkthroughs) with no…
• Datadog Security Labs (2026-10-05) analyzed Kubernetes RBAC across more than 65,000 clusters from nearly 10,000 organizations, focusing on bindings to system:anonymous, system:unauthenticated, and system:authenticated.
• Of more than 320,000 such bindings, most were distribution defaults or obsolete PodSecurityPolicy objects removed in Kubernetes 1.25, leaving about 44,000; more than 3,500 of those granted at least one permission Datadog classifies as…
• Datadog contrasts anonymous-auth defaults: EKS and GKE limit anonymous endpoints, AKS disables anonymous auth, and GKE's default for system:authenticated is unusually broad.
• The two reports do not contradict each other; they address different Kubernetes security questions (agent containment versus built-in principal RBAC).