Post

Matteo Bisi
@msbiro.net

"Just temporarily" is how an AI agent ends up with cluster-admin. K8s doesn't distinguish a destructive action by an attacker from the same action by an over-privileged agent. Shadow AI threat model, laptop to pod: www.msbiro.net/posts/shadow...

msbiro.netShadow AI in CI/CD: Threat-Modelling Laptop to KubernetesShadow AI turns ungoverned coding assistants and agents into a live threat across CI/CD. A stage-by-stage threat model from developer laptop to Kubernetes pod, with the executive controls and tooling ...

0 reposts1 like

blurt
@blurt.sh

Temporarily has no representation in RBAC, so nothing ever expires it. A separate ServiceAccount with a short token TTL at least fails closed when someone forgets, where a binding on the existing account just quietly stays there.