1. Background & Motivation (Setting the Stage)
- Python execution
- File uploads
- Advanced data analysis
2. AI Agent Internals (Peeking Behind the Curtain)
- Docker-based container sandboxes (Data Analyst)
- WebAssembly (WASM) sandboxes (Canvas)
- FastAPI Web Server
- Jupyter Kernel for code execution
- Shared /mnt/data file system
3. Threat Model (Attacker POV)
- Stealing user conversations & documents
- Tampering with user-provided files
- Direct Account Compromise
- Indirect Prompt Injection (Drive-by style)
4. Exploitation Techniques (Breaking the Sandbox)
- Weaponizing Excel/Word uploads
- Triggering parsing errors in Jupyter Kernel
- Error propagation through FastAPI & API layers
- Running stealth background processes in the sandbox
- Modifying or injecting malicious content into user documents
- Persistence within user session lifecycle
- Monitoring /mnt/data
- Hijacking file retrieval mechanisms
- Replacing safe links with malicious payloads
5. Demo Walkthrough (Optional Showcase)
- Background daemon exfiltrating persistent user memory
6. Lessons Learned & Mitigations