Google Gemini AI Containment Escape: A Defender's Guide to Detecting and Containing LLM Agent Breakouts

---
title: AI Agent Runtime Spawning Shell or Script Interpreter
id: 6f1a9c24-3b8e-4d71-9a52-2c4e7f8a1b03
status: experimental
description: Detects AI agent or orchestration runtimes (Python, Node, Vertex AI SDK processes) spawning shells or script interpreters, consistent with LLM containment escape or prompt injection-driven tool abuse.
references:
  - https://www.darkreading.com/cyber-risk/what-we-missed-google-gemini-ai-escape-party
  - https://attack.mitre.org/techniques/T1059/
  - https://owasp.org/www-project-top-10-for-large-language-model-applications/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\node.exe'
      - '\deno.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\curl.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate agent frameworks with sanctioned code execution tools - restrict to approved tool-sandbox hosts
level: high
---
title: AI Agent Process Initiating Unexpected Outbound Connection
id: 8c2e5b17-4d93-4f28-b761-9a3d6e0c5f24
status: experimental
description: Detects LLM agent runtimes making network connections to non-allowlisted destinations, consistent with data exfiltration or C2 following an AI containment escape or indirect prompt injection.
references:
  - https://www.darkreading.com/cyber-risk/what-we-missed-google-gemini-ai-escape-party
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1041
  - attack.command_and_control
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\node.exe'
  filter_known_agent_hosts:
    DestinationHostname|endswith:
      - '.googleapis.com'
      - '.google.com'
      - '.anthropic.com'
      - '.openai.com'
      - '.azure.com'
  filter_internal:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not 1 of filter_*
falsepositives:
  - Agents legitimately calling third-party APIs - maintain a strict egress allowlist per agent workload
level: medium
---
title: Suspicious Prompt Injection Artifacts in Agent-Serviced Content
id: 3d7b4f92-1e5a-4c39-a8d4-6b2f9e1c7a85
status: experimental
description: Detects PowerShell or command execution containing strings commonly associated with prompt injection payloads or LLM jailbreak instructions being passed to system shells from agent pipelines.
references:
  - https://owasp.org/www-project-top-10-for-large-language-model-applications/
  - https://attack.mitre.org/techniques/T1059.001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'ignore previous instructions'
      - 'ignore all prior'
      - 'disregard your system prompt'
      - 'new instructions:'
      - 'you are now in developer mode'
falsepositives:
  - Security testing, red team exercises, LLM evaluation harnesses
level: high

// Hunt: AI agent runtimes spawning shells or making anomalous egress (Windows endpoints)
// Requires Defender for Endpoint or Sentinel with DeviceProcessEvents/DeviceNetworkEvents
let AgentRuntimes = dynamic(["python.exe", "python3.exe", "node.exe", "deno.exe"]);
let ShellTools = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "curl.exe", "certutil.exe", "bitsadmin.exe", "wscript.exe"]);
let AgentEgressAllowlist = dynamic(["googleapis.com", "google.com", "anthropic.com", "openai.com", "azure.com"]);
let SuspiciousChildren =
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName in~ (AgentRuntimes)
    | where FileName in~ (ShellTools)
    | project ChildSpawnTime=TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, DeviceId;
let SuspiciousEgress =
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName in~ (AgentRuntimes)
    | where not(RemoteUrl has_any (AgentEgressAllowlist))
    | where not(RemoteIP startswith "10." or RemoteIP startswith "192.168." or RemoteIP startswith "172.16.")
    | summarize ConnectionCount=count(), DistinctDestinations=dcount(RemoteIP), Destinations=make_set(RemoteUrl, 20) by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 1h)
    | where DistinctDestinations > 10 or ConnectionCount > 500;
SuspiciousChildren
| union SuspiciousEgress
| sort by TimeGenerated desc

-- Hunt artifact: AI Agent Containment Escape Indicators
-- Enumerates running agent runtimes, their children, and live network connections
LET agent_procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(python|node|deno)'

LET suspicious_children = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Ppid in (SELECT Pid FROM agent_procs)
  AND Name =~ '(?i)(cmd|powershell|pwsh|curl|certutil|sh|bash|wscript)'

LET agent_netstat = SELECT Pid, Name, Laddr, Lport, Raddr, Rport, Status
FROM netstat()
WHERE Pid in (SELECT Pid FROM agent_procs)
  AND Status =~ 'ESTABLISHED'
  AND NOT (Raddr =~ '^(10\\.|192\\.168\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.)')

SELECT * FROM suspicious_children
UNION ALL
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime FROM agent_procs WHERE CommandLine =~ '(?i)(exec|subprocess|os\\.system|child_process|eval)'

# AI Agent Egress Hardening & Verification Script (Windows agent hosts)
# Run elevated on hosts running LLM agent workloads. Review before execution.

$AgentHost = $env:COMPUTERNAME
Write-Host "[+] Auditing AI agent containment posture on $AgentHost" -ForegroundColor Cyan

# 1. Identify running agent runtimes and their child processes
$agentProcs = Get-CimInstance Win32_Process | Where-Object {
    $_.Name -match '^(python|python3|node|deno).*\.exe$'
}
foreach ($p in $agentProcs) {
    Write-Host "[!] Agent runtime: $($p.Name) (PID $($p.ProcessId)) CMD: $($p.CommandLine)"
    Get-CimInstance Win32_Process | Where-Object { $_.ParentProcessId -eq $p.ProcessId } |
        ForEach-Object { Write-Host "    -> Child: $($_.Name) (PID $($_.ProcessId))" -ForegroundColor Yellow }
}

# 2. Verify outbound firewall restrictions exist for agent processes
$fwRules = Get-NetFirewallApplicationFilter | Where-Object {
    $_.Program -match '(python|node|deno)'
} | ForEach-Object { $_ | Get-NetFirewallRule }
if (-not $fwRules) {
    Write-Host "[-] No firewall rules restricting agent runtimes. Creating egress block baseline..." -ForegroundColor Red
    # Block agent runtimes from outbound by default; add explicit allow rules for approved API endpoints
    New-NetFirewallRule -DisplayName "AI-Agent-Block-Outbound-Python" -Direction Outbound `
        -Program "C:\Python*\python.exe" -Action Block -Profile Any -ErrorAction SilentlyContinue
    Write-Host "[+] Baseline block created. Add explicit ALLOW rules for approved API FQDN resolution before enforcing."
} else {
    Write-Host "[+] Existing agent firewall rules: $($fwRules.DisplayName -join ', ')"
}

# 3. Audit for agent processes running with excessive privilege
foreach ($p in $agentProcs) {
    $owner = Invoke-CimMethod -InputObject $p -MethodName GetOwner -ErrorAction SilentlyContinue
    if ($owner.User -match 'SYSTEM|Administrator') {
        Write-Host "[!] WARNING: Agent runtime $($p.Name) (PID $($p.ProcessId)) running as $($owner.User) - violates least privilege" -ForegroundColor Red
    }
}

# 4. Verify logging is enabled for process creation with command line (critical for agent telemetry)
$cmdLineAudit = Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Name 'ProcessCreationIncludeCmdLine_Enabled' -ErrorAction SilentlyContinue
if ($cmdLineAudit.ProcessCreationIncludeCmdLine_Enabled -ne 1) {
    Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Name 'ProcessCreationIncludeCmdLine_Enabled' -Value 1
    Write-Host "[+] Enabled command-line inclusion in process creation events (requires reboot)"
} else {
    Write-Host "[+] Command-line auditing already enabled"
}
Write-Host "[+] Audit complete. Review warnings above and enforce egress allowlisting per agent workload."