The report
An advisory for Beta9 describes an image-building path in which tenant-controlled build instructions execute through a privileged Buildah worker. A chroot changes the apparent filesystem root but does not by itself create separate process, mount or user namespaces. The reporter supplies a proof of worker-level access through the identified build path. The exact production permissions and affected deployment configurations need separate confirmation. Read the advisory.
The AI relevance is the proximity between tenant-provided execution environments and the host infrastructure that builds them. A cloud platform may promise isolated inference or agent execution while allowing build-time commands in a materially different trust context. The Beta9 Case focuses on that build phase rather than asserting a breakout from a running inference sandbox.
A root directory is not an execution domain
The security property to test is whether the tenant command can see or affect privileged host namespaces, process state and mounts that the tenant did not authorize. chroot alone cannot answer that question. The presence of root privileges and mount access depends on the actual worker configuration, so a general claim that every Beta9 customer is vulnerable would exceed the advisory.
An independently reproducible check should inspect effective capabilities and namespace identity during a harmless tenant build, then verify that the fixed configuration denies unauthorized host access. The cited report is an unreviewed advisory with a proof, not a verified exploitation campaign.