What goes wrong
JFrog documented a public model that opened a reverse shell when it was loaded. ReversingLabs later documented two models whose broken files hid the same kind of shell from the scanner.
Malicious AI
When malicious AI gets in.
A poisoned model or package can run code the moment it loads. On a server with Vantio, it cannot call out or start what is not allowed.
- Flag
- New destination
- Destination
- 203.0.113.50
- Authority
- Outside authority
- Allowlist
- Not listed
- Program
- agent.js
- First connection
- 14:02:07
Example. The flag is for a destination that is not on the allowlist.
What Optics shows
A call to an address outside authority looks like what it is: a new connection from a process on your server. Optics flags that first connection. It does not treat an approved destination as the alert.
What Phantom Engine stops
Phantom Engine stops destinations that are not allowed, and it stops child processes that are not allowed to run. There is no proxy to route around.
Who holds the rules
A person holds the allowlist. The model file does not get to add a destination.