Loading story…
AWS published a reference architecture for Amazon Bedrock AgentCore that limits AI agents to the requesting user’s permissions by propagating end-user authorization context to downstream services instead of enforcing access control in agent code. In the design, users authenticate through Amazon Cognito, custom claims such as department are added to JWTs, and AgentCore Runtime validates those claims before the agent runs. AWS said this approach reduces the risk of unauthorized data exposure from prompt injection or application bugs because the agent acts as an orchestrator rather than a trusted gatekeeper.
The architecture demonstrates three enforcement patterns across common enterprise data sources: user-scoped temporary AWS credentials for Amazon DynamoDB using STS AssumeRoleWithWebIdentity and session tags, metadata-based filtering for Amazon Bedrock Knowledge Bases, and OAuth 2.0 on-behalf-of token exchange for Salesforce through AgentCore Identity. In the example CRM workflow, Sales and Finance employees can use the same agent while only receiving records allowed by their own roles, with AWS also recommending stronger isolation such as separate knowledge bases and IAM policies where stricter separation is required.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
AWS published a security blog describing a reference architecture for AI agents built with Amazon Bedrock AgentCore that propagates end-user authorization context to downstream services such as DynamoDB, Bedrock Knowledge Bases, and Salesforce. The design aims to enforce least-privilege access outside the agent itself, including against prompt injection or application bugs.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourceaws.amazon.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Amazon has introduced new security features and best practices for its Bedrock platform, focusing on both API key management and the protection of generative AI applications. The release of Amazon Bedrock API keys provides developers with new options for accessing the Bedrock API, but also introduces potential security risks if not managed properly. AWS recommends using temporary security credentials from AWS Security Token Service (STS) as the preferred authentication method, as these credentials are short-lived and reduce the risk of long-term exposure. In cases where API keys must be used, AWS advises choosing short-term API keys over long-term ones, as they have built-in expiration mechanisms that limit the window of vulnerability if a key is compromised. For scenarios requiring long-term API keys, such as with certain third-party software, AWS suggests implementing strict controls and monitoring to mitigate risks. Service control policies (SCPs) can be used to restrict the creation and use of API keys, further reducing the attack surface. In addition to credential management, AWS has launched Amazon Bedrock Guardrails, a suite of configurable safeguards designed to protect generative AI applications from sophisticated attacks, including encoding-based threats. These guardrails provide six key protections: content filters, denied topics, word filters, sensitive information filters, contextual grounding checks, and automated reasoning checks. Encoding-based attacks, where malicious actors encode harmful content to bypass detection, are a growing concern for organizations deploying generative AI. Bedrock Guardrails address this by implementing a defense-in-depth strategy that detects and blocks encoded threats, such as base64 or hexadecimal representations of forbidden words. The safeguards are designed to work across multiple foundation models, including those hosted outside of Amazon Bedrock, ensuring broad applicability. AWS provides detailed guidance on implementing these protections, emphasizing the importance of balancing robust security with usability to avoid friction for legitimate users. Monitoring and auditing of API key usage, as well as regular review of guardrail configurations, are recommended to maintain a strong security posture. The combination of secure API key management and advanced guardrails positions Amazon Bedrock as a platform capable of supporting secure, scalable, and responsible generative AI deployments. Organizations are encouraged to adopt these best practices to protect sensitive data and maintain compliance with internal and external security standards. By leveraging these new features, enterprises can mitigate the risks associated with both credential exposure and advanced AI-specific attack vectors. The comprehensive approach outlined by AWS reflects the evolving threat landscape and the need for proactive, layered defenses in modern cloud environments. Security teams should stay informed about updates to Bedrock's security capabilities and continuously adapt their strategies to address emerging threats. The integration of these controls into development and operational workflows is essential for safeguarding AI-driven applications and maintaining trust in automated systems.
Jun 29, 2026
Researchers disclosed multiple **Amazon Bedrock AgentCore** security issues that can break the isolation expected in AI agent execution environments. One finding showed that *AgentCore Code Interpreter* sandboxes allowed outbound **DNS** queries despite a no-network-access design, enabling attackers to create a bidirectional command-and-control channel, exfiltrate data over DNS, and obtain an interactive shell. The impact depends heavily on the IAM role attached to the runtime: overprivileged access could expose AWS resources such as **S3** and allow broader compromise of data and connected services. A separate Bedrock AgentCore issue, tracked as **`CVE-2026-4269`**, affected the *AgentCore Starter Toolkit* and allowed **unauthenticated remote code execution** through **S3 bucket squatting**. By registering a predictable bucket name before a victim's build process, an attacker could inject malicious content into the agent runtime, gain control of the execution environment, manipulate model inputs and outputs, and potentially achieve lateral movement based on the runtime's IAM permissions. The flaw also introduced a **software supply chain** risk because compromised dependencies could be cached or embedded into CI/CD artifacts and persist across later deployments.
Jun 29, 2026
Security and platform experts warned that enterprise **AI agents** are creating identity and access risks that traditional governance models do not adequately cover. In one cloud audit, a fintech firm's LLM agent service account was found with excessive AWS permissions including `s3:*` and `iam:PassRole`, even though the agent only required limited access to a single bucket and model invocation. Researchers said non-human identities tied to agents have become a major blind spot because prompt injection and memory-layer abuse can expose credentials, enabling attack paths that move from token theft to lateral movement and persistence across production environments. Across the industry, practitioners are pushing for stronger controls built around **unified identity fabrics**, short-lived credentials, delegated authority, and continuous mapping of relationships among humans, applications, APIs, service accounts, and other agents. They also argued that enterprise deployments need structural least privilege and better auditability, with capability-scoped **MCP** connections favored over broad direct API integrations and brittle allowlists. The goal is to prevent agents from inheriting unchecked privileges, reduce orphaned or long-lived machine identities, and preserve accountability when autonomous agents create other agents or continue operating after their human owners change roles or leave the organization.
Jul 16, 2026