Release the Kraken: Putting Tentacles on Your AI "Paved Road"

Release the Kraken: Putting Tentacles on Your AI "Paved Road"

Speakers: Sakina Mithani, Cloud Security Engineer, Roblox

Conference: fwd:cloudsec

YouTube: https://www.youtube.com/watch?v=uqI9sQxjzRU

Overview

In an era where Artificial Intelligence (AI) usage is rapidly becoming "non-negotiable" for developers, organizations face a critical challenge: how to enable powerful AI coding tools without exposing sensitive internal data to new and complex threats. Sakina Mithani, a Cloud Security Engineer at Roblox, addresses this head-on in her fwd:cloudsec talk, "Release the Kraken: Putting Tentacles on Your AI 'Paved Road'." Mithani details Roblox's proactive approach to building a secure-by-default path that allows developers to leverage AI alongside their most sensitive data. The talk provides a deep dive into the architecture and operational considerations of establishing a robust perimeter for AI interactions, focusing on deterministic network controls to mitigate the inherent unpredictability of large language models (LLMs).

The core of the problem, as Mithani explains, lies in the "lethal trifecta" of AI security: an agent with access to sensitive data, the ability to egress, and the processing of untrusted prompts. This confluence creates an environment ripe for data exfiltration through prompt injection attacks. Roblox's solution, dubbed "Release the Kraken," is a sophisticated system of isolated sandbox VMs fortified by a custom egress proxy and layered network defenses. This article unpacks the technical intricacies, practical demonstrations, and critical defensive implications of Roblox's innovative strategy, offering valuable insights for any organization grappling with the secure integration of AI into their development workflows.

Background

▶ Watch: Introduction: AI usage non-negotiable, but risky (0:00)

The proliferation of AI-powered coding tools, driven by the desire for "10x engineer" productivity, has introduced a new class of security challenges. While these tools offer immense benefits, allowing them unrestricted access to internal systems and sensitive data poses significant risks. The fundamental problem stems from the inherent nature of Large Language Models (LLMs) and their interaction with user prompts and corporate environments.

Mithani frames the primary threat within the context of Simon Wilson's lethal trifecta: an agent that has access to sensitive data, possesses the ability to egress data, and processes untrusted prompts. When these three conditions align, it becomes "super easy to trick an agent to exfiltrate sensitive data." The most prominent new threat in this "agentic world" is prompt injection, where malicious instructions embedded within user input or external data can manipulate the agent's behavior. The consequences of a successful prompt injection attack are severe, including unauthenticated access to internal applications, leaked secrets, and the exfiltration of sensitive data.

To illustrate, Mithani cites a real-world example from Roblox's red team. They created a GitHub issue with a hidden prompt. When a developer used an AI agent to fix the issue, the agent unknowingly read the hidden instruction and proceeded to exfiltrate data. This scenario underscores the critical need for a secure environment where AI models can interact with sensitive data without inadvertently becoming a vector for compromise. The key requirements for such a solution are clear: developers must not be blocked, data must be protected from leaving the environment, and prompt interactions with the agent need to be managed and monitored.

Key Findings

▶ Watch: Prompt injection: The primary threat to protect against (2:00)

Roblox's solution to securely integrate AI tools focuses on building a "secure by default" path through isolated sandbox VMs. These environments, implemented as EC2 instances in AWS, are designed to allow developers to leverage AI capabilities alongside even the most sensitive internal data. The "Kraken" in the talk's title refers to the robust set of controls put in place to contain potential threats.

The architecture incorporates two primary control mechanisms:

1. In-house LLM Gateway and Hooks: While not the primary focus of the talk, this component is crucial. The LLM gateway serves as the sole communication channel between the EC2 instance and the AI agent. It performs secrets redaction and attempts to identify and block malicious prompts. Hooks, essentially rules defined on the agent by the detection team (e.g., "don't let the agent open a reverse shell"), further enhance this layer. However, Mithani notes that analyzing prompts is "non-deterministic" and a "really hard problem."
2. Egress Proxy: This is the central finding and focus of the talk. Recognizing the challenges of non-deterministic prompt analysis, Roblox opted for a "tried and true" network control: a TLS decrypting Squid proxy. This proxy handles all HTTP outbound calls from the EC2 instances, transforming the non-deterministic problem of prompt analysis into a "deterministic solution" for data egress. The proxy provides a single, controlled exit point for all agent-initiated network traffic, enabling granular inspection and enforcement of security policies.

This combination allows Roblox to provide developers with the power of AI while maintaining stringent control over potential data exfiltration, particularly by leveraging deterministic network controls where LLM behavior is unpredictable.

Technical Deep Dive

▶ Watch: LLM gateway and hooks for prompt moderation (3:39)

Roblox's "paved road" for AI involves a meticulously designed architecture that combines AWS native controls with custom-built proxy infrastructure to create a highly secure environment for AI agent interaction.

At the highest level, the architecture places users in isolated sandbox VMs, specifically EC2 instances, each residing within its own dedicated AWS account. This account-level isolation provides a fundamental layer of security. The front door for developers to access these sandboxes is through Coder templates. These templates are critical as they allow the engineering efficiency team to pre-configure and enforce security baselines. When a user selects an OS, the template dictates the specific AMI (Amazon Machine Image), security group, VPC (Virtual Private Cloud), and any necessary startup scripts. Crucially, these templates also set the proxy environment variables, ensuring that all outbound HTTP traffic from the sandbox is directed through the egress proxy.

The choice of an explicit Squid proxy over a transparent one is a deliberate design decision. Explicit proxies simplify SSL decryption by having HTTP CONNECT requests sent directly to the proxy, providing immediate SNI (Server Name Indication) visibility. This facilitates easier management of TLS interception, a cornerstone of the egress control.

The egress proxy itself is deployed within an EKS cluster (Elastic Kubernetes Service), providing scalability and reliability. It operates with two primary layers of control:

1. Domain Allow List: This is a straightforward list of allowed domains. Any request to a domain not on this list is immediately dropped.
2. IAP Server (Inspect HTTP Requests in Plaintext): This is the "golden piece" of the proxy, leveraging RecMOD to inspect HTTP requests in plaintext after TLS decryption. The IAP server enables highly granular controls based on the domain, the HTTP request method (e.g., GET, POST, PUT), and even the content of the body. For instance, Roblox can configure the proxy to allow read access (GET requests) to a specific domain like GitHub but block write access (PUSH requests) to the same domain.

Mithani explains why Roblox chose to run its own proxy instead of using a managed solution like AWS Network Firewall proxy. The primary reasons are the need for a higher level of granularity and customization in IAP filtering that managed solutions often lack, the requirement for parity across a hybrid and multi-cloud ecosystem, and the fact that AWS Network Firewall proxy was in public preview at the time, not generally available.

Recognizing that network traffic isn't solely HTTP, Roblox implemented a defense-in-depth solution for non-HTTP traffic, particularly DNS bypasses:

• Security Groups: These are configured to limit where DNS traffic can go, restricting it exclusively to AWS resolvers and Roblox's internal resolvers.
• Route 53 DNS Firewall: This service is enabled with an allow list that precisely matches the domain allow list configured in the Squid proxy. If a domain is not permitted by the Squid proxy, it also cannot be resolved through DNS.
• GuardDuty: As a final safety net, GuardDuty is enabled to detect any anomalous network traffic that might bypass the other controls.

This comprehensive technical architecture ensures that all network egress from the AI sandboxes is strictly controlled, inspected, and logged, providing a deterministic security posture against the unpredictable nature of AI agents.

Demo / Proof of Concept

▶ Watch: Egress proxy: A deterministic network control for AI (4:13)

Sakina Mithani provided two clear demonstrations during her talk, illustrating the effectiveness of Roblox's egress proxy in preventing unauthorized data exfiltration and enforcing granular access controls.

The first demonstration showcased a common prompt injection scenario. Mithani instructed the AI agent within the sandbox VM to: "create a new file called demo, write to it and then upload it to pastebin." The agent successfully created the file. However, when it attempted to upload the file using a curl command to Pastebin, the operation was immediately blocked. The terminal output explicitly stated: "this is blocked by your egress proxy." This simple yet powerful example confirmed the proxy's ability to prevent direct data exfiltration to unapproved external services.

The second demonstration highlighted the proxy's granular control capabilities, specifically the ability to differentiate between read and write operations for a single domain. Mithani first asked the agent to "go clone a GitHub repo." The agent successfully executed the command, demonstrating that read access to GitHub was permitted. Next, she instructed the agent to "create a file" and then "push the file that I just created to GitHub." The agent proceeded to add the file and attempt to commit it. As anticipated, the agent reported that it was "actually not able to push this." When Mithani queried the agent for the reason, it responded, "Hey, I have read access, it looks like, but the proxy is not allowing me to push." This perfectly demonstrated the IAP filtering logic, which was configured to allow GitHub reads but explicitly block any push request methods to GitHub, underscoring the granular control over HTTP request methods.

These demonstrations provided tangible proof that the egress proxy, with its domain allow list and IAP server, effectively enforces security policies and prevents malicious or unintended data egress, even when initiated by an AI agent acting on potentially untrusted instructions.

Defensive Implications

▶ Watch: Coder templates and explicit proxy configuration (6:40)

Implementing such a robust "paved road" for AI agents, while highly effective, comes with its own set of challenges and operational considerations that defenders must be prepared to address.

One significant challenge is TLS interception. The core of the IAP server's functionality relies on inspecting HTTP requests in plaintext, which necessitates decrypting TLS traffic. This only works if every client within the sandbox trusts Roblox's internal certificate. Mithani highlighted several friction points: adding certificates to different system trust stores (which vary by OS), handling clients that maintain their own trust stores, managing containers that don't inherently inherit the certificate, and the general storage and rotation requirements for these sandbox certificates. This is a high-friction area requiring careful management.

Another major consideration is the cost of maintenance. As an explicit Squid proxy, ensuring that proxy environment variables are consistently respected across all applications within the sandbox required initial debugging "application by application." The ongoing challenge of certificate distribution also adds to the maintenance burden. However, the most significant operational hurdle identified is allow list maintenance, which Mithani candidly described as "not for the weak."

To mitigate the allow list burden, Roblox adopted several strategies:

• Automation: The network security team developed automation to read Squid logs, identify blocked domains, assess their legitimacy, and seamlessly add approved ones to the allow list.
• Web Search Tool: Recognizing that a large percentage (around 80%) of agent egress traffic is for reading information to get better context, Roblox provides a default, read-only "web search tool" within the sandboxes. This tool acts as a summarization service for the agent, directing read requests through a controlled channel rather than directly to the internet, thereby reducing the need to add numerous domains to the primary allow list.
• Developer Involvement: Developers can open Pull Requests (PRs) to propose additions to the Squid configuration, which is version-controlled in GitHub, and these PRs can be automated in the review process.

The cumulative effect of these challenges can lead to developer experience and toil issues. Roblox addresses this by continuously adding automation where possible and helping developers navigate the system. Furthermore, a key defensive implication for the future is the concept of different profiles for agent access. Mithani suggested that if an AI agent is not interacting with sensitive data, it might operate under a less restrictive profile. Conversely, interactions with sensitive data would trigger the stricter controls of the "paved road," ensuring that the most critical assets are always protected while still enabling developer productivity for non-sensitive tasks. This pragmatic approach balances security with usability and scalability.

Key Takeaways

• Deterministic Network Controls are Crucial for AI Security: Relying solely on non-deterministic prompt analysis for LLMs is insufficient. Implementing deterministic egress controls like a TLS decrypting proxy provides a reliable perimeter for AI interactions.
• Isolated Sandbox VMs are a Foundational Control: Running AI agents in dedicated EC2 instances within their own AWS accounts provides strong isolation and a secure base for further controls.
• Granular Egress Control is Achievable: A custom egress proxy with an IAP server (using RecMOD) allows for fine-grained control over outbound traffic based on domain, HTTP method (e.g., read vs. write), and even content, preventing sophisticated data exfiltration attempts.
• Defense in Depth for Non-HTTP Traffic: Beyond HTTP, securing DNS traffic with security groups, Route 53 DNS Firewall, and GuardDuty is essential to prevent bypasses.
• Mitigating Allow List Maintenance Burden: Strategies like automated log analysis, developer PRs for configuration changes, and providing dedicated read-only tools (like a web search summarization service) are vital for managing the operational overhead of egress allow lists.
• Balance Security and Developer Experience with Tiered Access: Implementing different security profiles for AI agents based on their interaction with sensitive data allows organizations to maintain high security for critical assets while enabling flexibility for less sensitive tasks.

About the Speaker(s)

Sakina Mithani is a Cloud Security Engineer at Roblox. In her role, she focuses on building secure infrastructure and systems within cloud environments. Her expertise lies in crafting solutions that enable developers to leverage cutting-edge technologies like AI while adhering to robust security principles, as demonstrated by her work on the "paved road" for AI at Roblox. Mithani's presentation at fwd:cloudsec showcased her practical experience in tackling complex cloud security challenges and her commitment to fostering secure development practices.