Loading story…
AWS has open-sourced Dogwood, a new policy language released under Apache 2.0 that extends the Cedar authorization model to control sequences of AI agent tool calls rather than evaluating each request in isolation. Dogwood adds temporal, history-aware rules that can inspect prior tool-call events and outcomes, enabling controls such as approval requirements before sensitive actions, spending caps across multiple steps, and restrictions triggered after access to sensitive data. AWS said Dogwood works with AgentCore Policy and remains backward-compatible with Cedar.
AWS also cautioned that Dogwood’s temporal model introduces operational and security complexity, including statefulness, concurrency risks, and the loss of Cedar’s automated formal reasoning properties. The company said its reference interpreter is not intended for production authorization use and warned that trustworthy deployments require authenticated event records, trusted timestamps, durable trace storage, logging, tenant isolation, and retention controls to ensure policy decisions over agent activity can be relied upon.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
The MCP 2026-07-28 specification required method and tool-name headers so agent traffic would be visible to HTTP infrastructure. AWS linked Dogwood's release to this specification update.
AWS contributed the Cedar policy language to the CNCF as a sandbox project in late 2025, marking an earlier step in the evolution of its policy tooling.
AWS AgentCore Policy launched at AWS re:Invent in the prior year, providing the policy framework that AWS says supports Dogwood today.
AWS open-sourced Dogwood, a new policy language for governing AI agent tool calls with history-aware temporal rules, and released it under the Apache 2.0 license. AWS said Dogwood is backward-compatible with Cedar and works with AgentCore Policy.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AWS published a reference architecture for **Amazon Bedrock AgentCore** that limits AI agents to the requesting user’s permissions by propagating end-user authorization context to downstream services instead of enforcing access control in agent code. In the design, users authenticate through **Amazon Cognito**, custom claims such as department are added to JWTs, and **AgentCore Runtime** validates those claims before the agent runs. AWS said this approach reduces the risk of unauthorized data exposure from prompt injection or application bugs because the agent acts as an orchestrator rather than a trusted gatekeeper. The architecture demonstrates three enforcement patterns across common enterprise data sources: user-scoped temporary AWS credentials for **Amazon DynamoDB** using `STS AssumeRoleWithWebIdentity` and session tags, metadata-based filtering for **Amazon Bedrock Knowledge Bases**, and OAuth 2.0 on-behalf-of token exchange for **Salesforce** through AgentCore Identity. In the example CRM workflow, Sales and Finance employees can use the same agent while only receiving records allowed by their own roles, with AWS also recommending stronger isolation such as separate knowledge bases and IAM policies where stricter separation is required.
Aug 20, 2026
AWS published a Step Functions pattern that limits Amazon Bedrock AgentCore agents to proposing airline rebooking itineraries and compensation messages, while deterministic workflow code validates requests, routes decisions, manages retries, and executes reservation changes or payments. The design creates an auditable execution history and prevents probabilistic LLM output from directly triggering consequential financial, operational, or regulatory actions. AWS also highlighted Amazon Bedrock AgentCore Code Interpreter, a managed serverless sandbox for agents to execute code and analyze data dynamically. Abnormal AI uses the capability for real-time inline email-threat detection and computational verification, illustrating how isolated code execution can support agent-assisted security decisions while retaining controlled execution boundaries.
Sep 15, 2026
Amazon described two internal AWS disruptions tied to engineers using AI coding tools with operator-level permissions, emphasizing the incidents were **user error** rather than autonomous AI behavior. One event in December was described as an “extremely limited” impact affecting a single service in parts of mainland China, while a second incident reportedly did not affect a customer-facing AWS service. Amazon attributed the December issue to an access-control problem (“broader permissions than expected”) and said it implemented additional safeguards afterward, including **mandatory peer review** and staff training; employees also noted that normal two-person approval processes were bypassed in these cases. Separately, AWS expanded the ecosystem around coding agents by releasing **Agent Plugins for AWS**, an open-source plugin library that lets third-party coding agents perform AWS-specific actions (e.g., “deploy to AWS”) and generate architecture recommendations, cost estimates, and infrastructure-as-code for review before deployment. The initial *deploy-on-aws* plugin is designed to work in supported agent environments such as **Claude Code** and **Cursor**, increasing the ways AI agents can interact with AWS services—an expansion that heightens the importance of strong permissioning, review gates, and change-management controls highlighted by the earlier disruption reports.
Jun 29, 2026