Loading story…
Researchers disclosed multiple Amazon Bedrock AgentCore security issues that can break the isolation expected in AI agent execution environments. One finding showed that AgentCore Code Interpreter sandboxes allowed outbound DNS queries despite a no-network-access design, enabling attackers to create a bidirectional command-and-control channel, exfiltrate data over DNS, and obtain an interactive shell. The impact depends heavily on the IAM role attached to the runtime: overprivileged access could expose AWS resources such as S3 and allow broader compromise of data and connected services.
A separate Bedrock AgentCore issue, tracked as CVE-2026-4269, affected the AgentCore Starter Toolkit and allowed unauthenticated remote code execution through S3 bucket squatting. By registering a predictable bucket name before a victim's build process, an attacker could inject malicious content into the agent runtime, gain control of the execution environment, manipulate model inputs and outputs, and potentially achieve lateral movement based on the runtime's IAM permissions. The flaw also introduced a software supply chain risk because compromised dependencies could be cached or embedded into CI/CD artifacts and persist across later deployments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Orca Security identified three unsafe pickle deserialization vulnerabilities in SGLang, including two unauthenticated remote code execution flaws rated CVSS 9.8. The vulnerabilities were still unpatched at the time of reporting.
Miggo Security disclosed CVE-2026-25750, a high-severity URL parameter injection vulnerability in LangSmith that could enable token theft and account takeover through crafted links. The issue was remediated in LangSmith version 0.12.71.
BeyondTrust disclosed that Amazon Bedrock AgentCore Code Interpreter's sandbox mode permits outbound DNS queries, which can be abused for command-and-control, data exfiltration, and interactive shell access despite expected isolation. Amazon reportedly classified the behavior as intended functionality and recommended using VPC mode and DNS firewalling as mitigations.
A vulnerability tracked as CVE-2026-4269 was disclosed in the Amazon Bedrock AgentCore starter toolkit/runtime, where S3 bucket squatting could allow unauthenticated remote code execution. Successful exploitation could give attackers control of the AI agent execution environment, enabling data exfiltration, output manipulation, and possible lateral movement via the runtime's IAM role.
2 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcecvereports.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AWS disclosed **CVE-2026-16796**, a high-severity command argument injection flaw in the Bedrock AgentCore Python SDK before version `1.18.1` that can let an authenticated user execute arbitrary commands inside the Code Interpreter sandbox. The issue affects the `install_packages()` function, where crafted Python package specifiers and improperly neutralized argument delimiters can be passed into a shell-backed `pip install` flow, resulting in **CWE-88** command injection. The vulnerability carries a **CVSS v3.1 score of 7.3** and can expose sensitive data in the sandbox, including temporary files and environment tokens, with potential for further movement in weakly segmented environments. AWS said the fix in version `1.18.1` tightens validation for package inputs, including PEP 508 extras, and quotes package arguments with `shlex.quote`; users are advised to upgrade immediately to the patched release.
Jul 25, 2026
Researchers disclosed multiple vulnerabilities in enterprise AI agent frameworks that allowed attackers to bypass model authorization, trigger tools directly, and in some cases achieve **remote code execution**. Check Point reported 11 flaws across **LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK**, spanning insecure deserialization, **SSRF**, path traversal, and use-after-free. One critical issue in Microsoft Agent Framework let untrusted state data reach insecure checkpoint deserialization, enabling RCE; Microsoft fixed the bug and said no `CVE` was assigned because the product was not generally available. A separate disclosure described a cross-platform pattern dubbed **CoreBreak**, where execution layers in **Amazon Bedrock AgentCore, Google ADK, and Vercel AI SDK harnesses** accepted tool-call-shaped data without confirming that a legitimate model turn had authorized the action. AWS assigned **`CVE-2026-18830`** and automatically patched the managed service, Google fixed **`CVE-2026-18236`** in ADK for Python version **2.5.0**, and Vercel patched **`@ai-sdk/harness-codex` 1.0.29** and **`@ai-sdk/harness-opencode` 1.0.28**. Researchers said the findings show that the main risk lies in insecure agent orchestration and tool-execution logic, not prompt injection alone, with Google ADK also exposed to abuse that could write and run malicious Python code and leak API keys or cloud service account credentials.
Aug 6, 2026
Amazon disclosed **CVE-2026-12530**, a high-severity command injection vulnerability in the AWS Bedrock AgentCore Python SDK. The flaw is caused by improper neutralization of argument delimiters in the `install_packages()` method, allowing a remote authenticated user to supply crafted package-name arguments and execute arbitrary commands inside the Code Interpreter sandbox. The issue affects AWS Bedrock AgentCore Python SDK versions **1.1.3 through 1.6.0** and is rated as remotely exploitable. AWS has published a security bulletin for the vulnerability, and the recommended mitigation is to upgrade affected deployments to **version 1.6.1**.
Jun 29, 2026