Cracks in the Bedrock: Escaping the AWS Agent Core Sandbox
Summary: Unit 42 researchers found that Amazon Bedrock AgentCore's Code Interpreter sandbox mode, described by AWS as providing "complete isolation with no external access," still resolved arbitrary public domains and allowed a proof-of-concept DNS tunneling channel to an attacker-controlled nameserver at dnshook[.]site. The researchers also found the AgentCore Runtime's microVM Metadata Service accepted standard HTTP GET requests without a session token, which could let a server-side request forgery retrieve the agent's IAM role credentials.
What's compelling: The sandbox guarantee is what leads teams to attach highly privileged IAM roles to agent code, and a bidirectional DNS channel means stolen credentials do not have to stay trapped inside the microVM.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026