Back Gbhackers

AWS Bedrock AgentCore Sandbox Bypass Enables Stealthy C2 and Data Exfiltration

Gbhackers •Divya • March 18, 2026

A newly disclosed vulnerability in AWS Bedrock AgentCore Code Interpreter allows threat actors to bypass network isolation and establish stealthy command-and-control (C2) channels. AWS originally advertised this mode as providing complete isolation without external access, researchers found that it permits outbound DNS queries for A and AAAA records. This structural allowance enables attackers to exfiltrate […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AWS Bedrock Sandbox Vulnerability Enables DNS-Based Data Exfiltration A security flaw in AWS Bedrock's AgentCore Code Interpreter allows attackers to bypass network isolation through DNS queries. Researchers from BeyondTrust demonstrated that the sandbox mode permits outbound DNS queries for A and AAAA records, enabling covert command-and-control (C2) channels. This vulnerability can lead to data exfiltration and remote command execution if the associated IAM roles are overly permissive. AWS acknowledged the issue but classified it as intended functionality rather than a defect, opting not to issue a patch. The flaw was reported to AWS on September 1, 2025, with an initial fix rolled back in November 2025. The findings emphasize the architectural inadequacies of perimeter controls in AI execution environments. Organizations using AWS Bedrock are advised to audit their configurations and consider migrating sensitive workloads to VPC mode for enhanced security. 7 sources 68

Extracted Entities

AWS Bedrock AgentCore Sandbox Bypass Enables Stealthy C2 and Data Exfiltration

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (2)

Platforms (1)