The results of a study on the security of the isolated environment for executing Python code, used by Google in the Gemini chatbot, have been published. The Gemini chatbot provides tools for generating code from task descriptions and allows Python code to be executed immediately, relieving developers of the need for extra steps in testing it. The code runs in an isolated environment that is cut off from the outside world and only allows the execution of the Python interpreter. To determine the contents of the sandbox environment, researchers managed to run code that utilized the Python os library to traverse the contents of all directories and build a map of the file system.
Particular interest was sparked by the executable file /usr/bin/entry/entry_point, which was 579 MB in size. To extract this file, researchers created a script that sequentially output the contents in Base64 format in small chunks. On their end, they automated the stitching together of the data fragments using the Caido toolkit and obtained a copy of the file on their system.
For analyzing the obtained executable file, the binwalk utility was used, which is designed to extract files embedded in firmware. Among the extracted data was the google3 directory, which contained Python code with various components to support the service's operation, such as RPC for the interaction of the AI model Gemini with external Google services like YouTube, Google Flights, and Google Maps.
Examining the contents of the files showed that this is not confidential code and it has been approved for public access by Google's security service. Further analysis of the dump revealed the presence of proto files (Protocol Buffer) with specifications of internal data structures that allow for understanding the intricacies of data exchange between various Google services. The usefulness of the identified proto files is questionable, as similar proto files were already extracted by other researchers from Google App Engine seven years ago.
Source: opennet.ru
