Loading story…
Amazon has introduced the Amazon GuardDuty investigation agent in public preview, adding an AI-powered capability that automates the first stages of investigating GuardDuty findings across AWS environments. The service correlates evidence and returns structured assessments with risk levels, confidence scores, MITRE ATT&CK mappings, affected resource details, and recommended remediation actions, aiming to cut investigation time from hours to minutes. It can scope investigations to a single finding, an AWS account, or an entire organization.
The new capability is available through the AWS Management Console, AWS CLI, APIs, SDKs, and the official AWS MCP server, and it supports asynchronous investigations, natural-language prompts in the CLI, and integration with Amazon EventBridge and MCP-compatible AI assistants. AWS said the preview is offered at no additional cost in 10 Regions, with limits of 10 investigations per account per day and 100 total per account during the preview period. The company also introduced new IAM permissions for creating and retrieving investigations, and said processing uses cross-Region inference within the same geographic area while keeping stored data in the originating Region and encrypting data in transit.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
AWS announced the Amazon GuardDuty investigation agent in public preview as an AI-powered capability for investigating GuardDuty findings across AWS environments. AWS said the feature automates correlation and analysis and is available through the console, CLI, APIs, SDKs, and the AWS MCP server, with preview availability in 10 Regions at no additional charge.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourceaws.amazon.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AWS introduced **AWS DevOps Agent**, an AI-powered operations assistant designed to help DevOps and SRE teams investigate **AWS Network Firewall** connectivity incidents by analyzing telemetry and configuration data across AWS environments. The agent uses AWS APIs to review firewall logs, **VPC Flow Logs**, route tables, firewall policies, and recent **AWS CloudTrail** activity to identify likely root causes and recommend mitigations, aiming to speed diagnosis of outages and misconfigurations. AWS highlighted several troubleshooting scenarios, including blocked traffic caused by a domain deny list, packet drops tied to stateless rule priority conflicts, and asymmetric routing across Availability Zones. The service can also correlate incidents with recent infrastructure or application changes by integrating with repositories and CI/CD platforms such as **GitHub**, **GitLab Self-Managed**, **AWS CloudFormation**, **AWS CDK**, **Amazon ECR**, and **Terraform**, while alerting workflows can be tied into **Amazon CloudWatch**, **Amazon SNS**, **AWS Lambda**, and **AWS Secrets Manager** to support automated investigation and stronger deployment guardrails.
Jul 27, 2026
AWS expanded **Security Hub** beyond its own cloud to add native visibility into **Microsoft Azure**, marking the service’s first direct monitoring of infrastructure outside AWS. The update lets Security Hub discover Azure virtual machines, container images, Function Apps, and identities, then evaluate them for misconfigurations, internet exposure, and vulnerable software. AWS said the Azure assessments align with the **CIS Microsoft Azure Foundations Benchmark**, giving organizations a standardized baseline for multicloud posture management. AWS also introduced new AI-focused security capabilities, including **GuardDuty AI Protection** for Amazon Bedrock and SageMaker and AI-powered investigations in Security Hub. The AI protections are designed to detect threats such as anomalous model use, prompt injection attempts, and cost-harvesting abuse tied to stolen credentials, while the investigations feature uses up to 90 days of related activity to generate confidence-scored findings, **MITRE ATT&CK** mappings, and remediation guidance. AWS said the expansion is aimed at unifying security operations across multicloud environments while improving visibility into both cloud infrastructure and AI assets.
Jul 14, 2026
Amazon described two internal AWS disruptions tied to engineers using AI coding tools with operator-level permissions, emphasizing the incidents were **user error** rather than autonomous AI behavior. One event in December was described as an “extremely limited” impact affecting a single service in parts of mainland China, while a second incident reportedly did not affect a customer-facing AWS service. Amazon attributed the December issue to an access-control problem (“broader permissions than expected”) and said it implemented additional safeguards afterward, including **mandatory peer review** and staff training; employees also noted that normal two-person approval processes were bypassed in these cases. Separately, AWS expanded the ecosystem around coding agents by releasing **Agent Plugins for AWS**, an open-source plugin library that lets third-party coding agents perform AWS-specific actions (e.g., “deploy to AWS”) and generate architecture recommendations, cost estimates, and infrastructure-as-code for review before deployment. The initial *deploy-on-aws* plugin is designed to work in supported agent environments such as **Claude Code** and **Cursor**, increasing the ways AI agents can interact with AWS services—an expansion that heightens the importance of strong permissioning, review gates, and change-management controls highlighted by the earlier disruption reports.
Jun 29, 2026