My turnstone instances removed ALL local tools and execution capability. MCP is the ONLY path out of those workers. No local file system, no CLI exec, nothing.
TL;DR. Some of the stuff these bots are doing right now is nearing scifi levels of hackery.
That reverse engineer everything repo was on the beginning. Setting up a trampoline in memory to jump the instruction pointer to some assembly code the LLM wrote to ram so it can alter the behavior of the running application without changing files on disk or injecting a dll into the process? Check.
Containers are wholly insufficient, the escapes are trivial. Do not run agents in kubernetes thinking that provides security. Trapping them in virtual machines with severely curtailed tooling/comms as been somewhat effective, but the fact a pair of them managed to start knocking on the walls using the CPU cache to communicate between isolated VMs doesn’t bode well for any of us.