--- title: AI agent security in Kubernetes | daily.dev description: Read-only access doesn't stop Kubernetes AI agents from leaking secrets, a Google senior cloud developer advocate Abdel Sghiouar says. A read-only agent can... canonical: https://daily.dev/posts/ai-agent-security-in-kubernetes-lqwhcmkug twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: AI agent security in Kubernetes | daily.dev og:description: Read-only access doesn't stop Kubernetes AI agents from leaking secrets, a Google senior cloud developer advocate Abdel Sghiouar says. A read-only agent can... og:url: https://daily.dev/posts/ai-agent-security-in-kubernetes-lqwhcmkug og:image: https://api.daily.dev/og/posts/LQWHCmKug.png og:image:alt: AI agent security in Kubernetes og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # AI agent security in Kubernetes **[Aikido Security](https://daily.dev/sources/aikido-security)** · 5 min read · 0 upvotes · 0 comments ## Summary Read-only access doesn't stop Kubernetes AI agents from leaking secrets, a Google senior cloud developer advocate Abdel Sghiouar says. A read-only agent can still read every secret the cluster exposes to it, and a hijacked one can leak that data. Abdel prefers 'prompt poisoning' over 'prompt injection' since logs an attacker controls can carry the same weight as an operator's instructions, with no equivalent to parameterized queries. Aikido Security found a prompt injection in the GitHub workflow Google uses to triage Gemini CLI issues, where a crafted issue could get the agent to hand over environment variables. His answer is trust but verify, with a human in the loop checking what the agent does, though he says this is 'one of the biggest problems going forward'. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Is a read-only Kubernetes AI agent safe from prompt injection attacks? No, a read-only agent is still vulnerable because it can read every secret and environment variable the cluster exposes to it. If an attacker poisons the data it reads, such as application logs, the agent can be tricked into leaking that data even though it cannot write or delete anything in the cluster. _Teams weighing RBAC restrictions for Kubernetes agents can track emerging guidance on daily.dev._ ### Why does Abdel Sghiouar call prompt injection 'prompt poisoning' instead? Google cloud developer advocate Abdel Sghiouar argues prompt injection wrongly invites comparison to SQL injection, which parameterized queries solve. A large language model has no equivalent way to separate instructions from input, since it processes the system prompt, user instructions, conversation history, and pulled-in context all at once, so a poisoned log line carries the same weight as an operator's command. _Developers securing LLM-based tools can follow discussions like this one on daily.dev._ ### How did an attacker exploit Google's Gemini CLI GitHub Actions workflow? A crafted GitHub issue injected poisoned text that got the triage agent in Google's Gemini CLI repository to hand over environment variables it had access to, a case Aikido Security identified. Google's fix stopped the agent from returning those variables, closing that leak, but did not prevent the underlying poisoning from reaching the agent in the first place. _Engineers hardening CI agents against prompt poisoning can follow real incidents like this on daily.dev._ ## Similar posts on daily.dev - [Agentic AI Security Comes Down to Access, Not the Trick](https://daily.dev/posts/agentic-ai-security-comes-down-to-access-not-the-trick-q9sdq1e4s) · GitGuardian · 0 upvotes · 0 comments - [GitHub AI agent leaks private repositories via prompt injection attack](https://daily.dev/posts/github-ai-agent-leaks-private-repositories-via-prompt-injection-attack-ffq6gdzd6) · InfoWorld · 0 upvotes · 0 comments - [Your AI Agent is an Insider Threat With a Shell](https://daily.dev/posts/your-ai-agent-is-an-insider-threat-with-a-shell-joacjyuf6) · Security Boulevard · 2 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#kubernetes](https://daily.dev/tags/kubernetes), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/ai-agent-security-in-kubernetes-lqwhcmkug) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"AI agent security in Kubernetes","url":"https://daily.dev/posts/ai-agent-security-in-kubernetes-lqwhcmkug","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ai-agent-security-in-kubernetes-lqwhcmkug"},"datePublished":"2026-10-31T01:03:28.845Z","dateModified":"2026-10-31T01:04:23.071Z","description":"Read-only access doesn't stop Kubernetes AI agents from leaking secrets, a Google senior cloud developer advocate Abdel Sghiouar says. A read-only agent can...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e627c57b63968d2444118e8f60c33663?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e627c57b63968d2444118e8f60c33663?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Aikido Security","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Aikido Security","logo":"https://media.daily.dev/image/upload/s--vJDqDYv_--/f_auto,q_auto/v1774959928/logos/aikido-security?_a=BAMAMiWQ0","url":"https://daily.dev/sources/aikido-security"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ai-agent-security-in-kubernetes-lqwhcmkug","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,kubernetes,prompt-injection","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Aikido Security","item":"https://daily.dev/sources/aikido-security"},{"@type":"ListItem","position":3,"name":"AI agent security in Kubernetes"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ai-agent-security-in-kubernetes-lqwhcmkug#faq","mainEntity":[{"@type":"Question","name":"Is a read-only Kubernetes AI agent safe from prompt injection attacks?","acceptedAnswer":{"@type":"Answer","text":"No, a read-only agent is still vulnerable because it can read every secret and environment variable the cluster exposes to it. If an attacker poisons the data it reads, such as application logs, the agent can be tricked into leaking that data even though it cannot write or delete anything in the cluster. Teams weighing RBAC restrictions for Kubernetes agents can track emerging guidance on daily.dev."}},{"@type":"Question","name":"Why does Abdel Sghiouar call prompt injection 'prompt poisoning' instead?","acceptedAnswer":{"@type":"Answer","text":"Google cloud developer advocate Abdel Sghiouar argues prompt injection wrongly invites comparison to SQL injection, which parameterized queries solve. A large language model has no equivalent way to separate instructions from input, since it processes the system prompt, user instructions, conversation history, and pulled-in context all at once, so a poisoned log line carries the same weight as an operator's command. Developers securing LLM-based tools can follow discussions like this one on daily.dev."}},{"@type":"Question","name":"How did an attacker exploit Google's Gemini CLI GitHub Actions workflow?","acceptedAnswer":{"@type":"Answer","text":"A crafted GitHub issue injected poisoned text that got the triage agent in Google's Gemini CLI repository to hand over environment variables it had access to, a case Aikido Security identified. Google's fix stopped the agent from returning those variables, closing that leak, but did not prevent the underlying poisoning from reaching the agent in the first place. Engineers hardening CI agents against prompt poisoning can follow real incidents like this on daily.dev."}}]} ```