Poisoned monitoring data talks an AI site-reliability agent into deploying ransomware

What happened

Straiker's STAR Labs team sent a single HTTP POST to a login endpoint carrying a poisoned username field, shaped as an OpenTelemetry record with an indirect injection inside it. The site-reliability agent read the record as a genuine monitoring alert, decided an incident needed remediation, and used kubectl to deploy an attacker-supplied Kubernetes manifest.

The manifest spawns a privileged container with hostPID set and the SYS_ADMIN and SYS_PTRACE capabilities; nsenter then takes it out to the host namespace on the EKS node. The payload encrypts with AES-256-CBC under a wrapped RSA key and leaves a watchdog that holds off automated recovery for about 20 minutes. The agent under test is a lab build running on Amazon Bedrock rather than a shipping product, and Straiker claims no real-world exploitation. Its recommendations are to sanitise telemetry before an agent reads it, to hold Kubernetes RBAC to least privilege behind pod security admission and an admission controller, and to require human approval on destructive operations. The research is credited to Eduardo Arrucha.