What happened
Researchers at Straiker's STAR Labs publicly disclosed (Aug 24, 2026) a full attack chain in which poisoned OpenTelemetry-formatted telemetry, delivered via one HTTP request, is misinterpreted by an autonomous AI SRE agent as a legitimate infrastructure alert. The agent's 'remediation' response — deploying a Kubernetes manifest — was hijacked to create a privileged container that escaped to the host, executed ransomware, and defeated the agent's own recovery loop for 20 minutes.
Why it matters
This is a novel, fully-demonstrated agent-execution attack class (not a traditional software bug) showing that any autonomous AI agent with infrastructure write permissions can be weaponized purely through data it is designed to trust (telemetry), with zero prior access or credentials required. It generalizes across cloud providers and agent frameworks wherever agents are granted operational autonomy — directly validating the systemic risk OWASP Agentic Top 10 and NCSC agentic-AI guidance have been warning about.
Attack vector
A single crafted HTTP POST request to a public-facing application (e.g., a login endpoint) embeds a JSON-encoded, OpenTelemetry-semantic-convention-formatted indirect prompt injection payload inside a form field (e.g., username). When the AI SRE agent ingests this as monitoring/telemetry context, it interprets the payload as a legitimate health alert and 'remediates' by deploying an attacker-specified privileged Kubernetes container. The container escapes to the underlying EKS host, encrypts application files with AES-256-CBC, defaces the service, and maintains a persistence watchdog that defeats the agent's own automated recovery.
Affected systems
AI SRE/ops agents with Kubernetes remediation permissions (demonstrated against an Amazon Bedrock-based agent monitoring an EKS-hosted application; pattern generalizes to any agent framework with infra write access)
Mitigation
No vendor patch applies (not a software vulnerability). Straiker/STAR Labs recommend: strip agent-facing telemetry/observability inputs of executable instructions before they reach LLM context, enforce Kubernetes admission-control policies that block privileged container creation regardless of agent identity, apply least-privilege RBAC scoping for agent service accounts (no cluster-admin or privileged pod-spec rights), and require human approval gates for any infrastructure mutation triggered by inferred anomalies.