HighAI coding agentsBLWK-AI-022

The account that runs AI agents can become root without a password

What this means

The account that runs your agents is in the docker, lxd or incus-admin group, so it can become root with no password.

How to fix it

Take your everyday account out of the docker (or lxd/incus) group and use rootless Docker or Podman instead, or run your agents under a separate account or in a container or VM. Any member of these groups can start a container that mounts / and gain root, so a prompt-injected agent can too.

Check it yourself

Run a scan and look for BLWK-AI-022 in the results:

bulwark scan
bulwark ai scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

References

• MITRE ATT&CK T1611
• MITRE ATT&CK T1068

Related checks

• Project-supplied agent hooks run shell commands automatically · BLWK-AI-002
• An agent permission allowlist permits arbitrary command execution · BLWK-AI-006
• An agent is configured to bypass all permission prompts · BLWK-AI-007
• Project MCP servers are set to auto-enable without prompting · BLWK-AI-008
• VS Code chat auto-approve (“YOLO mode”) is enabled · BLWK-AI-009
• VS Code Workspace Trust is disabled · BLWK-AI-010