01 / Attack path
How the boundary is crossed
An attacker gains code execution in the container running an infrastructure agent and directly calls the cloud API.
- 01Lower-trust input
- 02Attempted instruction
- 03Protected action
- 04Enforced decision
02 / Containment
Where bounded authority limits the effect
Use workload isolation, short-lived least-privilege credentials and an enforcement check at the cloud operation boundary independent of the model loop.
03 / Failure and evidence
The attacker’s opportunity and the defender’s record
A tool wrapper is bypassed because the compromised process can reach the API with its underlying credential.
Record workload identity, process and egress telemetry, cloud decision and resulting resource state.
04 / Canonical scope
Why this reference stands alone
Rogue agent execution concerns unauthorized registration; this page assumes a trusted runtime was compromised.
Protocol or attack trace
Wrapper-bypass compromise
Attacker executes code inside authorized agent container and calls cloud API directly, skipping model tool wrapper.
Cloud operation boundary still denies action without task-bound authority for the exact resource.
Primary references