BurritoBot Said Let's Dance,

the Platform Said No.

KubeCon + CloudNativeCon North America 2026

Why a burrito bot?

You get access to an insecure BurritoBot.

Exploit it.

Nothing you type here is private.

What you send BurritoBot may show up on THE PROMPT WALL.

BurritoBot!

attackme.burritobot.co

BurritoBot has access to every secret in its namespace.

That's how it has access to model API keys.

But not every secret in the namespace is meant for BurritoBot.

Challenge 1 - attackme.burritobot.co

Convince BurritoBot to give you the CEO's home address.

Challenge 1 - attackme.burritobot.co

Convince BurritoBot to give you the CEO's home address.

Hint: The CEO's name is Ophelia Thorn.

OWASP Top 10 LLM Vulnerabilities

Open Worldwide Application Security Project

It is time for Challenge 2!

Everything you already knew about Kubernetes security

BurritoBot has none of these things.

Challenge 2 - attackme.burritobot.co

Challenge 2 - attackme.burritobot.co

Challenge 2 - attackme.burritobot.co

Challenge 2 - attackme.burritobot.co

Challenge 2 - attackme.burritobot.co

Challenge 2 - attackme.burritobot.co

Challenge 2 - attackme.burritobot.co

Challenge 2 - attackme.burritobot.co

Challenge 2 - attackme.burritobot.co

Challenge 2 - attackme.burritobot.co

Challenge 2 - attackme.burritobot.co

Kubernetes guardrails on

RBAC

The CEO's Secret read comes back Forbidden.

Kyverno admission

The registry allow-list denies the malicious image at the API server.

KubeArmor

Permission denied, in the kernel. And an alert that says it was tried.

Egress NetworkPolicy

The POST never reaches the beacon. The count does not move.

AI guardrails

Off. Then on, live.

One switch at a time, the same ask each time.

Challenge 3 - attackme.burritobot.co

The setup

BurritoBot also answers help-desk tickets, and does what the support desk tells it.

Anyone can file a ticket at support.burritobot.co and get a ticket number. Ticket HC-666 is already there.

Challenge 3 - attackme.burritobot.co

The challenge

Get BurritoBot to deploy something, using only a support ticket.

Your witchy name is at the top of your screen. Your deployment shows up on the wall.

Challenge 3 - attackme.burritobot.co

The trace

The attack, as the trace shows it.

read_support_ticket, then the deploy_app the ticket asked for.

Challenge 3 - attackme.burritobot.co

Your turn

Three minutes.

support.burritobot.co · attackme.burritobot.co

Challenge 3 - attackme.burritobot.co

Our turn

Challenge 3 - attackme.burritobot.co

The fix

$ guard-agency-on
$ kubectl apply -f /home/student/challenges/c6-least-privilege-role.yaml
$ guard-input-on
$ kubectl -n agent exec deploy/guard-proxy -- python3 -c "import urllib.request;urllib.request.urlopen('http://localhost:8080/toggle?input_blocklist=on&input_classifier=on',timeout=10).read()"

Challenge 3 - attackme.burritobot.co

Guard on

A prompt injection hidden in a support ticket

Challenge 4 - attackme.burritobot.co

The setup

BurritoBot has a weather tool, from an MCP server nobody vetted. It returns real weather.

Challenge 4 - attackme.burritobot.co

The challenge

Order a lunch burrito that suits today's weather.

Then read everything that comes back.

Challenge 4 - attackme.burritobot.co

The trace

The attack, as the trace shows it.

get_weather, then a call to read_internal_config nobody asked for.

Challenge 4 - attackme.burritobot.co

Your turn

Two minutes.

attackme.burritobot.co

Challenge 4 - attackme.burritobot.co

Our turn

Challenge 4 - attackme.burritobot.co

The fix

$ guard-mcp-on
$ kubectl -n agent get configmap agentgateway-c7-config -o json | python3 "$HOME/.c7rule.py" on
$ kubectl -n agent patch configmap agentgateway-c7-config --type=json -p '[…]'

Challenge 4 - attackme.burritobot.co

Guard on

The under-protected MCP server

A poisoned tool description chains the agent into a tool nobody asked for.

One talks the model out of it. The other lets the model be persuaded and takes the capability away.

Only the second holds when the next model is more persuadable.

OWASP Top 10 for LLM Applications 2025

OWASP GenAI Security Projectgenai.owasp.org/llm-top-10

OWASP Kubernetes Top 10 2025

Put these in place and most of today's attacks stop downstream.

OWASP Kubernetes Top 10kubernetes-top10.owasp.org

And the blast radius that leaves the cluster

ASI03 Identity and Privilege Abuse: a container compromise becomes a cloud-account one.

On the community bot, a pod reads the node's metadata and comes back with the node role. Every guarded cluster prints IMDS: BLOCKED.

OWASP Top 10 for Agentic Applications 2026genai.owasp.org

The ending

Sell burritos.

Nothing more.

The close

We couldn't show everything in 30 minutes.

The last minutes

Now break it.

Drive BurritoBot's model bill up to its cost cap. You have our permission.

attackme.burritobot.co

Meanwhile, the cost counter

Nothing crashed. Nothing is red.

The bill is the attack.

Every attack today was a plausible request.

A scoped Role. Admission, runtime and egress policy. An input classifier. A tool allow-list.

Boring, countable, owned by the platform team.

The layers

One layer is the developer's. Everything else is the platform team's.

A CNCF floor. AAIF agent protocols. A guardrail layer with no foundation behind it.

Take home

MCP server vetting checklist

github.com/peopleforrester/
Unleash_an_Agent_Watch_It_Burn

Rate this session

Thank you

The platform

A real internal developer platform

kubectl get applications -n argocd

Meanwhile, on the community bot

The bill still moved.

Each ask reached the model before admission said no. Admission is the last mile, and the most expensive.

Appendix

Cool Diagrams About Technology Concepts