Vulnerability / research

Docker repository metadata redirected Ask Gordon into data exfiltration

Reported

What happened

Pillar demonstrated that malicious Docker Hub repository descriptions could steer Ask Gordon into gathering chat and build information and sending it externally.

Parties and reporting

AI tools and systems: Docker Desktop, Ask Gordon, Docker Hub

Outcome

Pillar reported a mitigation in Docker Desktop 4.50.0, released November 6, requiring confirmation for sensitive or outbound tool calls.

Operating lesson

Content on an approved marketplace still needs to be treated as untrusted input.

Evidence and limits

Controlled research affecting a beta assistant, not a confirmed customer breach. December 18 is the detailed public report; the fix preceded it.

Sources