Blind Trust in AI-Generated Code: How the Attack Surface Forms

▶ Watch (2:01)

The opening scenario shows a developer asking an AI to build, containerize, and deploy a full e-commerce site called KubeCon Shopping. Code review is skipped because the AI “is smarter than me.” The Dockerfile and Kubernetes manifests are merged without inspection. The AI sets privileged: true and hostPID: true in the manifest. Neither setting triggers any warning in the workflow. Production deploy succeeds in minutes, with no human ever reading the generated YAML.

CVE-2025-5102: CVSS 10 RCE and Node Takeover

▶ Watch (5:52)

The attacker identifies the site as Next.js with React Server Components. AI fingerprinting surfaces CVE-2025-5102, a 2025 vulnerability scored 10 out of 10 that allows remote code execution. A Python exploit is generated in seconds. Running hostname remotely returns KubeCon Shopping 5 F F R Z, confirming code execution inside the container. Because the pod runs privileged with hostPID, the attacker then sends shutdown -t 1 -a from inside the container directly to the node. The node goes down.

Why Privileged Containers Break Container Isolation

▶ Watch (19:43)

Containers isolate processes on Linux. Without extra settings, a shutdown inside a container fails with a permission error. The AI-generated manifest broke that isolation in two ways. hostPID: true makes all node processes visible from inside the container. privileged: true grants every host capability to the container process. Together they let the attacker treat the container as a root shell on the node. The Kubernetes Pod Security Standard baseline profile requires both fields to be false. The manifest violated that profile on day one.

Hardening the Container Image with Distroless and Trivy

▶ Watch (14:14)

Three layers of the container image can carry vulnerabilities: application code and libraries, packages added during the build, and the base image itself. Trivy and Kube-bench scan all three automatically and can run in CI. The demo shows Trivy catching CVE-2025-5102 before deploy. Switching to a distroless base image via multi-stage build removes bash and unnecessary tools entirely. Running bash in a distroless container fails by design. Attackers who gain code execution find far fewer commands available. kubectl debug with an ephemeral container replaces kubectl exec for legitimate inspection.

Admission Control and AI-Assisted Remediation

▶ Watch (24:12)

Two controls catch bad manifests before pods deploy. Trivy manifest scanning flags privileged: true as severity high. Policy-based admission control intercepts the Kubernetes API request. Validation mode blocks the deploy outright. Mutation mode overwrites the non-compliant field and allows it. Pod Security Admission is the simplest starting point and enforces Pod Security Standards natively. For custom policies or mutation logic, other tools are needed. Connecting the Trivy MCP server to an AI agent lets the agent scan a Dockerfile, container image, or manifest, then generate a fix without a human running each command manually.

Notable Quotes

Even AI can make mistakes. It’s really important not to just blindly trust the result generated by AI Keita Mochizuki · ▶ 13:36

it’s possible that uh a malicious prompt was injected somewhere. Keita Mochizuki · ▶ 21:22

the distroless image doesn’t even include bash. That means hackers can’t execute any command even the container was infiltrated. Aoi Takahashi · ▶ 17:27

The setting privilege true is detected as severity high. So, with this result, we can notice insecure configurations before deploying the pod. Keita Mochizuki · ▶ 24:01

Key Takeaways

  • AI-generated manifests can introduce privileged: true and hostPID: true, enabling full node compromise.
  • CVE-2025-5102, scored 10 out of 10, allowed remote code execution on an unpatched Next.js app.
  • Distroless base images remove bash, shrinking attacker options after a container is breached.
  • Trivy flags privileged: true as high severity when scanning manifests before deployment.
  • The Trivy MCP server lets an AI agent scan and patch Dockerfiles and manifests without manual steps.

About the Speaker(s)

Aoi Takahashi is a Site Reliability Engineer at Recruit Co., Ltd., where she manages the Study Sapuri educational platform. She contributes to Kubernetes documentation by translating it into Japanese and has published both a professional book and a self-published manga on learning Kubernetes for beginners.

Keita Mochizuki is a Software Engineer at NTT DATA Japan Corporation covering platform development and technical research. He has published Japanese books on Kubernetes security and managing Kubernetes secrets with HashiCorp Vault, contributes to upstream Kubernetes, and recently helped develop the Kubecolor dev up command.