Loading story…
AWS published a Step Functions pattern that limits Amazon Bedrock AgentCore agents to proposing airline rebooking itineraries and compensation messages, while deterministic workflow code validates requests, routes decisions, manages retries, and executes reservation changes or payments. The design creates an auditable execution history and prevents probabilistic LLM output from directly triggering consequential financial, operational, or regulatory actions.
AWS also highlighted Amazon Bedrock AgentCore Code Interpreter, a managed serverless sandbox for agents to execute code and analyze data dynamically. Abnormal AI uses the capability for real-time inline email-threat detection and computational verification, illustrating how isolated code execution can support agent-assisted security decisions while retaining controlled execution boundaries.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
AWS published a case study describing Abnormal AI's use of Amazon Bedrock AgentCore Code Interpreter, a managed serverless sandbox, to support real-time inline email-threat detection and computational verification.
AWS published an AWS Step Functions pattern in which Amazon Bedrock AgentCore agents propose replacement itineraries and compensation messages, while deterministic workflow steps validate and execute reservation changes or payments with an auditable execution history.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AWS published a reference architecture for **Amazon Bedrock AgentCore** that limits AI agents to the requesting user’s permissions by propagating end-user authorization context to downstream services instead of enforcing access control in agent code. In the design, users authenticate through **Amazon Cognito**, custom claims such as department are added to JWTs, and **AgentCore Runtime** validates those claims before the agent runs. AWS said this approach reduces the risk of unauthorized data exposure from prompt injection or application bugs because the agent acts as an orchestrator rather than a trusted gatekeeper. The architecture demonstrates three enforcement patterns across common enterprise data sources: user-scoped temporary AWS credentials for **Amazon DynamoDB** using `STS AssumeRoleWithWebIdentity` and session tags, metadata-based filtering for **Amazon Bedrock Knowledge Bases**, and OAuth 2.0 on-behalf-of token exchange for **Salesforce** through AgentCore Identity. In the example CRM workflow, Sales and Finance employees can use the same agent while only receiving records allowed by their own roles, with AWS also recommending stronger isolation such as separate knowledge bases and IAM policies where stricter separation is required.
Aug 20, 2026
Researchers disclosed multiple **Amazon Bedrock AgentCore** security issues that can break the isolation expected in AI agent execution environments. One finding showed that *AgentCore Code Interpreter* sandboxes allowed outbound **DNS** queries despite a no-network-access design, enabling attackers to create a bidirectional command-and-control channel, exfiltrate data over DNS, and obtain an interactive shell. The impact depends heavily on the IAM role attached to the runtime: overprivileged access could expose AWS resources such as **S3** and allow broader compromise of data and connected services. A separate Bedrock AgentCore issue, tracked as **`CVE-2026-4269`**, affected the *AgentCore Starter Toolkit* and allowed **unauthenticated remote code execution** through **S3 bucket squatting**. By registering a predictable bucket name before a victim's build process, an attacker could inject malicious content into the agent runtime, gain control of the execution environment, manipulate model inputs and outputs, and potentially achieve lateral movement based on the runtime's IAM permissions. The flaw also introduced a **software supply chain** risk because compromised dependencies could be cached or embedded into CI/CD artifacts and persist across later deployments.
Jun 29, 2026
Amazon described two internal AWS disruptions tied to engineers using AI coding tools with operator-level permissions, emphasizing the incidents were **user error** rather than autonomous AI behavior. One event in December was described as an “extremely limited” impact affecting a single service in parts of mainland China, while a second incident reportedly did not affect a customer-facing AWS service. Amazon attributed the December issue to an access-control problem (“broader permissions than expected”) and said it implemented additional safeguards afterward, including **mandatory peer review** and staff training; employees also noted that normal two-person approval processes were bypassed in these cases. Separately, AWS expanded the ecosystem around coding agents by releasing **Agent Plugins for AWS**, an open-source plugin library that lets third-party coding agents perform AWS-specific actions (e.g., “deploy to AWS”) and generate architecture recommendations, cost estimates, and infrastructure-as-code for review before deployment. The initial *deploy-on-aws* plugin is designed to work in supported agent environments such as **Claude Code** and **Cursor**, increasing the ways AI agents can interact with AWS services—an expansion that heightens the importance of strong permissioning, review gates, and change-management controls highlighted by the earlier disruption reports.
Jun 29, 2026