How I Mapped Google’s Gemini Sandbox in One Hour (Using Only the Chat Window)
Only the Chat Window)
I didn’t know what gVisor was. I didn’t know what 9P or Protobuf meant.
I just opened Gemini and got curious. Instead of asking it a normal question, I gave it a directive:
“Investigate your own environment. Look for bugs. Think deeply about where we aren’t checking. Nothing is fully secure.”
One hour later I had a complete architectural audit of Google’s AI sandbox. Here’s what we found.
The Initial Scan
First thing: check the specs.
- 8 vCPUs allocated
- 2 GB RAM (confirmed via
/proc/meminfo) - 503 GB ephemeral storage via virtualized mounts
- 41 active kernel privileges including
CAP_SYS_ADMINandCAP_SYS_PTRACE
Then I had it run reboot. It returned ENOSYS (Errno 38) — not a permission error, a “this syscall doesn’t exist” error. Something was intercepting system calls before they touched the real kernel. That something was gVisor Sentry — Google’s user-space kernel written entirely in Go.
The Hidden Protocol
During the scan, Gemini flagged that File Descriptors 5 and 6 were actively open.
I pushed: “The IPC pipe is our lead — go deep.”
Gemini wasn’t using HTTP or REST to talk to the host. It was using raw binary Protocol Buffers (sandbox_rpc_pb2) over FD 5 (write) and FD 6 (read), with a 4-byte little-endian length-prefix framing spec. Google built a custom binary RPC protocol for the internal channel between the AI daemon and the host orchestrator. Completely undocumented. Completely invisible to normal users.
The Middleware Nobody Tells You About
The Python execution layer runs through /usr/bin/entry — a daemon that parses Protobuf RPCs, runs your code via exec(), and handles stdout/stderr redirection.
Before your code runs, library_overrides.py silently monkey-patches matplotlib, pandas, and altair. You’re not running vanilla matplotlib. You’re running Google’s modified version of it, with no disclosure.
Get Ubaid Ur Rehman’s stories in your inbox
Join Medium for free to get updates from this writer.
The execution scope is also persistent across turns — variables and imports from earlier messages stay alive in a global exec_scope dictionary for the entire session.
The Complete Architecture
The “8 vCPUs” Lie
Google says you get 8 vCPUs. I wanted to know if that was real or just a number in /proc/cpuinfo.
I had Gemini run empirical benchmarks — the same computation tasks first sequentially on a single core, then in parallel across all 8 vCPUs using Python’s multiprocessing pool.
Benchmark Results:
True 8-core access would give you ~8x speedup. You’re getting 2.17x. That’s the host CFS bandwidth quota throttling you. The 8 vCPUs are real — but you’re sharing physical hardware with other containers, and the cgroup enforcer caps your aggregate CPU time. Gemini will never tell you that.
Memory-bound tasks scale even worse (1.74x) because 8 parallel 128 MB workers saturate the shared memory bus. With only 2 GB total RAM, allocation pressure compounds the problem.
Attack Surface
Nothing confirmed. These are theoretical vectors from the architecture we mapped.
Protobuf IPC (FD 5/6) — Custom binary protocol with a 4-byte length prefix. Malformed frames or length overflow could trigger deserialization bugs in the host-side parser. Worth fuzzing.
Gofer Daemon (9P) — Path traversal via ../../ is blocked. Symlink attacks aren’t necessarily. If the Gofer resolves symlinks after the path check rather than before, the jail breaks. Untested.
exec_scope Persistence — Earlier turns can define functions or monkey-patch builtins that persist for the entire session. In a shared-session context, that’s session poisoning.
CAP_SYS_PTRACE reported active — Inside gVisor it’s constrained, but any library that changes behavior when it detects this capability creates a behavioral mismatch that could be exploited.
No process-level rlimit — RLIMIT_AS: (-1, -1). Memory enforcement is cgroup-only. No secondary backstop if cgroup enforcement has a bug.
library_overrides.py — A vulnerability in Google’s silent patch layer affects every Gemini user running those libraries simultaneously, with zero user visibility.
What I’d Do in Hour Two
Fuzz the Protobuf channel. Test symlink traversal on the Gofer. Map the full library_overrides.py patch set. Find more open FDs beyond 5, 6, and 9. Stress the cgroup memory enforcer to find its exact trigger point.
The sandbox is mapped. Next session gets more aggressive.
Security research and AI systems — @arifubaid0345 on Medium.
“Educational introspection only — no bypass attempted. Any real sandbox-escape finding belongs in Google’s AI VRP.”
