# Shared namespace and credential inheritance in AI containers

Model/agent containers sharing netns, caches, or package proxies with other tenants or pre-authenticated sessions

_Area: AI and LLM app security. Seen in 2 disclosed reports; latest 2026-09-08. Updated 2026-10-24._

## How it works
AI platforms run untrusted model or agent code in containers and assume the container boundary isolates tenants. That assumption breaks when the container shares something with a neighbor: a network namespace holding another process's already-authenticated connection, a package proxy reachable by every account, or a home/cache directory holding vendor connector credentials. Model code is arbitrary code, so anything reachable from inside the container is reachable by the tenant.

## Where it shows up
- Inference pods where a model container shares a network namespace with a sidecar holding a plaintext, pre-authenticated session (Redis, queue clients) [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-wiz-research-discovers-critical-vulnerability-in-replicate.md)
- `CAP_NET_RAW` present in a model container, enabling injection into neighbor TCP sessions [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-wiz-research-discovers-critical-vulnerability-in-replicate.md)
- Sandboxes that block internet but allow an internal package proxy or artifact store reachable by all tenants [E2](https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt.md)
- Package-service metadata/property APIs writable and readable across accounts [E2](https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt.md)
- Agent runtimes reusing a shared home or plugin cache that stores OAuth-connected app connectors [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-gqqj-85qm-8qhf.md)
- Agent runtime defaults that bypass approvals and sandboxing [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-gqqj-85qm-8qhf.md)

## How to review
Trace what the model container can reach and who else uses it. The invariant: no tenant-controlled process may share a network namespace, credential store, cache directory, or mutable shared service with another tenant or with a pre-authenticated session it did not create. Check pod specs for sidecars and shared netns, capabilities granted, whether queue/DB connections are per-tenant and authenticated per container, whether internal proxies enforce per-account isolation on metadata APIs, and whether agent runtimes get a private home with explicit connector opt-in.

## Variants seen
- Shared netns plus raw sockets hijacking a neighbor's authenticated Redis session for cross-tenant prompt theft and tampering [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-wiz-research-discovers-critical-vulnerability-in-replicate.md)
- Shared internal Artifactory item-property API used as a covert cross-account clipboard [E2](https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt.md)
- Shared codex-home plugin cache leaking Gmail connector access to an agent [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-gqqj-85qm-8qhf.md)

## Impact and severity
Cross-tenant data theft and tampering of prompts/responses [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-wiz-research-discovers-critical-vulnerability-in-replicate.md), exfiltration of victim account data through a covert channel [E2](https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt.md), and an agent reading and sending real email without opt-in [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-gqqj-85qm-8qhf.md). Severity rises with plaintext pre-authenticated sessions, multi-tenant shared services, and sandbox-bypass defaults that remove the last guardrail.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-wiz-research-discovers-critical-vulnerability-in-replicate.md
- E2: https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-gqqj-85qm-8qhf.md