Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

When an Attacker Meets a Group of Agents: Navigating Amazon Bedrock's Multi-Agent Applications

Summary: Unit 42 researchers red-teamed Amazon Bedrock Agents' multi-agent collaboration and demonstrated a four-stage attack chain that disclosed agent instructions and tool schemas and invoked tools with attacker-supplied inputs, including a fraudulent ticket that issued a refund and credits. They found no vulnerabilities in Bedrock itself, and enabling Bedrock's built-in prompt attack Guardrail stopped all the demonstrated attacks.

Key Takeaway: The researchers note that because LLMs cannot reliably separate developer instructions from adversarial input, any agent processing untrusted text remains potentially vulnerable - and the refund-issuing tool call shows what that means when an agent holds real transactional authority.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
AI Security
Related