AgentShield：Linuxカーネルにおける暴走AIエージェントの封じ込め

ステージ上で、実際のコンテナ内で動作するAIエージェントがLLMのAPIキーを外部に持ち出そう（窃取しよう）と試み、わずか数秒で成功する。ここでAgentShieldを有効にし、同じタスクを実行する。すると、3つのレイヤーが同時に介入する。まずカーネルレベルのチェックが不審なプロセスを一時停止し、ネットワークレイヤーのチェックが外部への接続を拒否し、さらにTLSレイヤーのすり替えによって本物のAPIキーが「ファントム（偽の）キー」に置き換えられる。エージェントは自身が成功したと信じ込むが、本物のキーがホストの外に出ることは決してない。ダッシュボードにはリアルタイムの因果関係チェーン（Causal Chain）が表示され、すべてのカーネルイベントが、それを引き起こしたLLMのプロンプトやツール呼び出しと紐付けられる。オペレーターが「Deny（拒否）」をクリックすると、その旨が型定義されたツールエラーとしてエージェントにそのまま返される。デモでは、その後各レイヤーを1つずつ無効化して何がすり抜けてしまうのかを示し、さらにデーモンを強制終了させてホストが安全に稼働し続けることを実演する。受講者は、ツールを使用するあらゆるAIエージェントをLinuxカーネルの内部から「可観測（オブザーバブル）」かつ「封じ込め可能（コンテナブル）」にするための、具体的な設計パターンを持ち帰ることができる。

Location :
- Track 3(Room 3)
Category :
- Bluebox
Share :

Speakers

Weixiao JI

ウェイシャオ・ジー

Weixiao Ji is a security engineer on the Security Research and Innovation Team at Lenovo's Global Security Lab in Beijing, where he works on Linux kernel observability and runtime protection. He is the creator of AgentShield, an eBPF-based system that makes autonomous AI agents observable and containable by enforcing boundaries directly in the kernel. He is a co-author of Efidrill — Automated Hunting UEFI Firmware Vulnerability through Data-Flow Analysis — presented at Black Hat Asia 2024 Arsenal (https://www.blackhat.com/asia-24/arsenal/schedule/#efidrill-automated-hunting-uefi-firmware-vulnerability-through-data-flow-analysis-36764): the first open-source IDA plugin for data-flow analysis of UEFI firmware, which discovered multiple vulnerabilities on platforms from Asus, Intel, and Dell (https://github.com/cc-crack/efidrill). His research focuses on applying eBPF, LSM hooks, and credential isolation to the new threat surface opened up by tool-using LLM agents.

Weixiao Ji is a security engineer on the Security Research and Innovation Team at Lenovo's Global Security Lab in Beijing, where he works on Linux kernel observability and runtime protection. He is the creator of AgentShield, an eBPF-based system that makes autonomous AI agents observable and containable by enforcing boundaries directly in the kernel. He is a co-author of Efidrill — Automated Hunting UEFI Firmware Vulnerability through Data-Flow Analysis — presented at Black Hat Asia 2024 Arsenal (https://www.blackhat.com/asia-24/arsenal/schedule/#efidrill-automated-hunting-uefi-firmware-vulnerability-through-data-flow-analysis-36764): the first open-source IDA plugin for data-flow analysis of UEFI firmware, which discovered multiple vulnerabilities on platforms from Asus, Intel, and Dell (https://github.com/cc-crack/efidrill). His research focuses on applying eBPF, LSM hooks, and credential isolation to the new threat surface opened up by tool-using LLM agents.
Qingzhe Jiang

チンジャー・ジャン

I am a security researcher with over 10 years of experience in cybersecurity and currently serve as Senior Manager and Head of the Security Research and Innovation Department at Lenovo. My work focuses on AI agent and LLM security, automated vulnerability discovery, and IoT and PC firmware security. I have also contributed to the development of several commercial APT detection engines.

I am a security researcher with over 10 years of experience in cybersecurity and currently serve as Senior Manager and Head of the Security Research and Innovation Department at Lenovo. My work focuses on AI agent and LLM security, automated vulnerability discovery, and IoT and PC firmware security. I have also contributed to the development of several commercial APT detection engines.

Back to Time Table