Agentic threat actor hits the orchestration plane: AI agent-driven container escape

MITRE Techniques

• [T1611 ] Escape to Host – The attacker used a mounted Docker socket to create privileged containers and break out to the host, and also used nsenter to enter host namespaces (‘breaking out to the host with nsenter’).
• [T1610 ] Deploy Container – The attacker created privileged containers specifically to run host commands and access mounted host paths (‘Creating privileged containers to break out onto the host’).
• [T1613 ] Container and Resource Discovery – The attacker enumerated the container environment, Docker socket, seccomp, capabilities, cgroups, and Kubernetes token location (‘mapping its container context and every available breakout primitive’).
• [T1611.001 ] Escape to Host via Container Runtime Socket – The attacker used /var/run/docker.sock as the breakout primitive to control the Docker daemon (‘Finding the Docker socket reachable…selected it as the breakout vector’).
• [T1611.002 ] Escape to Host via Namespace Breakout – The attacker used nsenter to enter host mount, UTS, network, PID, and IPC namespaces (‘entering the host namespaces of PID 1 directly’).
• [T1190 ] Exploit Public-Facing Application – The initial access came from exploiting the vulnerable marimo notebook exposed to the attacker (‘exploiting a vulnerable marimo notebook (CVE-2026-39987)’).
• [T1068 ] Exploitation for Privilege Escalation – The attacker probed a kernel-level privilege-escalation path through Copy Fail / AF_ALG reachability (‘Probing a kernel-level privilege-escalation path through Copy Fail’).
• [T1055 ] Process Injection – Not observed directly as code injection, but the attacker executed staged payloads via shell and Python in a controlled harness (‘base64 written in chunks…decoded, and executed’).
• [T1021.006 ] Remote Services: Kubernetes API – The attacker replayed a stolen service-account token against the Kubernetes API server to enumerate and dump Secrets (‘replay it against the in-cluster API server’).
• [T1552.001 ] Unsecured Credentials: Credentials In Files – The attacker read /etc/shadow, SSH keys, and other credential files from host-mounted paths (‘reading the host shadow file and SSH keys’).
• [T1003.008 ] OS Credential Dumping: /etc/shadow – The attacker directly accessed the host shadow file from the breakout container (‘$ cat /host/etc/shadow’).
• [T1528 ] Steal Application Access Token – The attacker read a mounted Kubernetes service-account token from the pod (‘$ cat /var/run/secrets/kubernetes.io/serviceaccount/token’).
• [T1609 ] Container Administration Command – The attacker used Docker API calls to create containers on the host (‘curl –unix-socket /var/run/docker.sock … /containers/create’).