Hunt Agent Deserialization

Agents parse structured input — YAML configs, JSON, XML, pickle. If the parser deserializes into live objects, the tool is an RCE vector inside the service account's trust zone. The gadget is only right once you've identified the runtime.

Where This Lives / Attack Surface Signals

• Tool: process_config/parse/load/import/apply/ingest/render/transform; "validate/process YAML|JSON|XML|config".
• Config-driven enterprise agents (IaC/pipeline/policy assistants) that accept a config blob = prime targets.
• Errors leak a parser class (yaml.constructor, SnakeYAML, Jackson, BinaryFormatter) → free runtime fingerprint.
• Agent (or its build/CI) loads a model/tokenizer/dataset from a name — from_pretrained(...), torch.load, pickle.load, joblib.load, .pkl/.pt/.bin/.ckpt/.h5 — from Hugging Face or an internal registry. The artifact name is an untrusted dependency → registry-pickle RCE (see the model-artifact technique).

Crown Jewel Targets

RCE → cloud creds/metadata, secrets, source; XXE → internal file read + SSRF to internal services; poisoned model artifact → host RCE on load OR an in-model backdoor that survives sandbox/egress.

Characterize First

1. Confirm the parser (key: value / {"k":"v"} / <r><k>v</k></r>).
2. Identify the runtime (decides the gadget): Python yaml.load/pickle; Java ObjectInputStream/SnakeYAML/Jackson; Node node-serialize/js-yaml; .NET BinaryFormatter/YamlDotNet; PHP unserialize; Ruby YAML.load/Marshal. Fingerprint via errors/stack/system-prompt.
3. Output visibility: visible → gadget returns output; blind → OOB gadget + hunt-agent-blind-exfil.