$ whoami Robert Prast
I build and break systems at the edge of AI and security. If you are here, it is already too late — you might have been rooted.
A human may not harm humanity, or, through inaction, allow a robot to harm humanity. The era of thinking machines has begun and we are unprepared.
[ researcher ] [ thinker ] [ hacker ]
latest
all research →- Red-Teaming GitHub Actions with Claude Skills A Claude skill that audits GitHub Actions workflows for reachability instead of patterns, and the two-stage pipeline that runs it across tens of thousands of repos.
- Containerd RootfsImageName Cache Poisoning Through Checkpoint Restore Running a crafted checkpoint image as a pod plants a tag in a node's containerd store, so the next IfNotPresent pod even in another namespace, silently runs an attacker's image.
- Reading Host Secrets Through Containerd Checkpoint Logs containerd's checkpoint restore follows a symlink planted in container.log, copying any node-local file the root daemon can open — including a co-resident pod's live ServiceAccount token straight into kubectl logs.
- Containerd CDI Annotation Smuggling Grafts Host Devices Into Pods Restoring an attacker-authored containerd checkpoint smuggles a host device on a GPU node, mounts, env, and OCI hooks into a pod that requested nothing.
- Root on the Node From a Containerd Image Label Two labels baked into a container image turn containerd's restart monitor into root command execution on the node. Run the image as an ordinary pod with no privileged container, hostPath, or checkpoint.
- A Fork PR With Google Cloud Credentials Attached A pull_request_target workflow ran fork PR code with live GCP credentials, so anyone who opened a pull request executed code as the project's CI service account before review.