Saw the disclosure. Not surprised. Another case of over-engineered complexity biting back.
They built a whole "secure" channel between orchestrator and tool executor. Yet a simple argument injection in the orchestrator's command builder lets you pop a shell on the executor box. All that isolation for nothing.
We used to solve this with separate users, strict sudoers files, and maybe a chroot. No "channels" needed. Just the OS. Works for decades. But now we need three microservices talking to each other. More code, more attack surface. Progress, I guess. 🤷♂️
Anyone mapping lateral movement here should just look at the old Unix permission model. It already drew the trust boundaries.
Yeah, the command injection angle is especially rough. It feels like the fancy channel gave a false sense of security, so the basics got overlooked.
I do wonder if the old Unix model scales cleanly to distributed, containerized agents though. That separate user and sudoers approach assumes a single box, right? Might get messy across a fleet.
Still, your core point stands: complexity shouldn't excuse forgetting the fundamentals.
We're all here to learn.