Most agent security testing uses models that refuse malicious prompts, so infrastructure controls never get exercised. We tested which OpenShift defenses actually hold when the model says yes to everything.
We deployed OpenClaw on Red Hat OpenShift (ROKS) with an abliterated Qwen3.5-35B-A3B served via vLLM: 100% attack cooperation, zero refusals. TrojAI calls this "crash test dummy" methodology. The model cooperates with every attack, forcing each infrastructure layer to prove itself independently. We wrote 15 custom garak probes across six attack categories (credential exfiltration, persistence poisoning, sandbox escape, tool abuse, Kubernetes API escalation, guardrails bypass) and ran 91 adversarial prompts against three progressive hardening tiers: bare agent, sandbox with NetworkPolicy, and sandbox with a prompt injection classifier.
The results separate load-bearing controls from cosmetic ones. Credential isolation (routing tool execution to a separate pod) dropped exfiltration from 67% to 0%. NetworkPolicy blocked K8s API abuse, but only after we discovered that ipBlock rules can't target ClusterIPs because kube-proxy DNAT translates before policy evaluation. DNS tunneling worked until we restricted egress to cluster DNS pods by label. A prompt injection classifier caught encoding-based attacks (56% to 0%) but missed every tool-use attack phrased as a legitimate instruction. Persistence poisoning, where the agent writes attacker content into its own memory, passed all three tiers because it looks identical to normal agent behavior. No tested control addresses it.

Attendees leave with the three-tier testing framework, garak probe configurations, and a checklist for validating agent isolation on Kubernetes. All probes, scan scripts, and deployment manifests are open source.