Back Cybersecuritynews

AWS Bedrock AgentCore Sandbox Bypass Allows Covert C2 Channels and Data Exfiltration

Cybersecuritynews •Guru Baran • March 17, 2026

A significant security flaw in AWS Bedrock AgentCore Code Interpreter’s “Sandbox” network mode, a feature advertised by AWS as providing complete network isolation that allows outbound DNS queries, enabling threat actors to establish covert command-and-control (C2) channels and exfiltrate sensitive data. AWS Bedrock AgentCore Code Interpreter is a managed service that allows AI agents and […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AWS Bedrock Sandbox Vulnerability Enables DNS-Based Data Exfiltration A security flaw in AWS Bedrock's AgentCore Code Interpreter allows attackers to bypass network isolation through DNS queries. Researchers from BeyondTrust demonstrated that the sandbox mode permits outbound DNS queries for A and AAAA records, enabling covert command-and-control (C2) channels. This vulnerability can lead to data exfiltration and remote command execution if the associated IAM roles are overly permissive. AWS acknowledged the issue but classified it as intended functionality rather than a defect, opting not to issue a patch. The flaw was reported to AWS on September 1, 2025, with an initial fix rolled back in November 2025. The findings emphasize the architectural inadequacies of perimeter controls in AI execution environments. Organizations using AWS Bedrock are advised to audit their configurations and consider migrating sensitive workloads to VPC mode for enhanced security. 7 sources 68

Extracted Entities

AWS Bedrock AgentCore Sandbox Bypass Allows Covert C2 Channels and Data Exfiltration

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (2)

Platforms (1)