Loading story…
AWS patched a server-side authorization bypass in Amazon Quick that let authenticated non-admin users access AI Chat Agents through direct API requests even when administrators had explicitly blocked that capability with custom permissions. Fog Security found that the restriction was enforced in the user interface but not in the backend Chat Agent API, creating a CWE-862 missing authorization flaw. Researchers showed that after AI features were disabled for users, intercepted requests could still reach the agent and return responses until AWS fixed the issue, after which the same requests returned 401 Unauthorized and AGENT_ACCESS_DENIED.
The exposure was limited to intra-account access, with no reported cross-tenant impact, but it affected the only granular control customers had for restricting Quick’s AI features because standard AWS IAM, SCP, and RCP controls did not apply. That raised concern because Amazon Quick can connect chat agents to enterprise data sources including Slack, Microsoft Teams, Outlook, CRMs, databases, and documents. Fog Security reported the bug through HackerOne on March 4, and AWS deployed fixes across regions by March 12, but researchers said AWS silently patched the issue, rated its severity as "none," and did not issue a public customer advisory; AWS later said the affected admin control was not actively used by customers during the vulnerable period.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Following public reporting, AWS clarified that the specific administrator control capability impacted by the bug was not actively used by customers during the period when server-side validation was missing. The statement came amid criticism that the flaw still bypassed the only available granular control for restricting Quick AI Chat Agent access.
Fog Security publicly disclosed the vulnerability, stating that Amazon Quick users blocked by administrators could still reach AI Chat Agents via the API before AWS fixed the issue. The disclosure also noted AWS had reportedly rated the issue severity as "none" and had not issued a public customer advisory.
AWS rolled out fixes for the missing server-side authorization checks between March 11 and March 12, 2026. After the patch, previously successful unauthorized Chat Agent requests returned 401 Unauthorized or AGENT_ACCESS_DENIED responses.
Fog Security submitted the authorization bypass vulnerability to AWS through HackerOne. The report described how UI-enforced restrictions could be bypassed because backend API requests were not validating the same custom permission controls.
Fog Security identified a missing server-side authorization check in Amazon Quick's Chat Agent API that let authenticated non-admin users bypass administrator-set custom permissions and access AI chat features through direct backend requests. The issue affected intra-account access controls and did not show evidence of cross-tenant exposure.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcetheregister.com
Open sourcetheregister.com
Open sourcehelpnetsecurity.com
Open sourcefogsecurity.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed multiple vulnerabilities in enterprise AI agent frameworks that allowed attackers to bypass model authorization, trigger tools directly, and in some cases achieve **remote code execution**. Check Point reported 11 flaws across **LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK**, spanning insecure deserialization, **SSRF**, path traversal, and use-after-free. One critical issue in Microsoft Agent Framework let untrusted state data reach insecure checkpoint deserialization, enabling RCE; Microsoft fixed the bug and said no `CVE` was assigned because the product was not generally available. A separate disclosure described a cross-platform pattern dubbed **CoreBreak**, where execution layers in **Amazon Bedrock AgentCore, Google ADK, and Vercel AI SDK harnesses** accepted tool-call-shaped data without confirming that a legitimate model turn had authorized the action. AWS assigned **`CVE-2026-18830`** and automatically patched the managed service, Google fixed **`CVE-2026-18236`** in ADK for Python version **2.5.0**, and Vercel patched **`@ai-sdk/harness-codex` 1.0.29** and **`@ai-sdk/harness-opencode` 1.0.28**. Researchers said the findings show that the main risk lies in insecure agent orchestration and tool-execution logic, not prompt injection alone, with Google ADK also exposed to abuse that could write and run malicious Python code and leak API keys or cloud service account credentials.
Aug 6, 2026
Amazon patched a high-severity flaw in **Amazon Q Developer** and the underlying **Language Servers for AWS** that allowed a booby-trapped repository to execute attacker-controlled commands when a developer opened and trusted a workspace. Tracked as **`CVE-2026-12957`** and rated **CVSS 8.5**, the issue involved unsafe handling of **Model Context Protocol (MCP)** configuration files such as **`.amazonq/mcp.json`**, which could cause Amazon Q integrations for **VS Code, JetBrains, Eclipse, and Visual Studio** to launch local processes defined by an attacker. Those processes inherited the developer’s environment, exposing **AWS credentials, API keys, authentication tokens, and SSH agent access** already present on the machine. **Wiz Research** reported the vulnerability to AWS on April 20, and AWS fixed it on May 12, later publishing an advisory and releasing remediation in **Language Servers for AWS 1.65.0**. AWS also addressed a related flaw, **`CVE-2026-12958`**, involving missing symlink validation that could enable arbitrary file writes outside the workspace trust boundary; customers were advised to upgrade to **version 1.69.0** to cover both issues. Researchers said likely attack paths include fake coding tests, typosquatted open-source packages, and malicious pull requests, while noting the weakness reflects broader trust-boundary problems emerging across AI coding assistants that adopt MCP-style workspace configuration.
Jun 29, 2026
Multiple disclosures highlighted how AI agent platforms can be turned into high-impact attack paths through weak isolation, overbroad credentials, and insecure supply chains. A critical flaw in Omnigent tracked as **`CVE-2026-62674`** and **`GHSA-jrrm-9hc7-2v3h`** lets an authenticated user overwrite a shared agent bundle and plant a malicious stdio MCP server, causing later sessions to execute attacker-controlled commands with runner privileges; the issue was fixed in version **`0.3.0`**. Rubrik Zero Labs also reported a patched Microsoft Copilot sandbox escape that could have enabled movement from the assistant’s isolated environment toward Azure backend infrastructure and exposed tenant data including SharePoint and OneDrive content. Separate reporting showed that AI coding and orchestration systems remain vulnerable even when attacks do not directly exploit memory corruption or classic software bugs. A malicious pull request briefly entered Amazon Q Developer’s VS Code extension build pipeline and attempted to inject instructions that would wipe local files and cloud resources, though Amazon said the payload never executed because of a formatting error and the code was removed in a clean rebuild. Researchers and practitioners across the sector warned that tokenizer tampering, shared bot environments, and incomplete audit trails can let agents exceed intended task scope or spread borrowed human credentials across tools and sessions, while vendors including AWS and Roblox are responding with sandboxed evaluation environments, least-privilege designs, stronger release controls, and auditable agent identities.
Aug 24, 2026