AWS Bedrock Tool - Vulnerability Enables Data Exfiltration

The Flaw

Cybersecurity researchers have identified a serious vulnerability within the AWS Bedrock AgentCore Code Interpreter. This flaw allows attackers to potentially exfiltrate sensitive data by exploiting how the tool handles DNS queries within its sandbox environment. Although AWS Bedrock's sandbox mode is designed to isolate AI code execution, it still permits DNS queries for A and AAAA records. This oversight creates a pathway for attackers to embed stolen data or commands within these DNS requests, effectively bypassing the isolation intended by the sandbox.

Researchers from BeyondTrust's Phantom Labs demonstrated a proof-of-concept system that enabled two-way communication with the AI, allowing data to be exfiltrated through these DNS queries. This vulnerability raises significant concerns about the security of data processed within AWS Bedrock, particularly for organizations relying on this tool for sensitive operations.

What's at Risk

The implications of this vulnerability are considerable. Organizations using AWS Bedrock for AI and machine learning tasks could find their sensitive data at risk. The flaw has been assigned a severity score of 7.5 out of 10, indicating a high level of concern. If exploited, this vulnerability could lead to unauthorized access to confidential information, impacting business operations and customer trust.

AWS was first alerted to this issue in September 2025, but a fix released in November was pulled due to technical issues. By December, AWS opted to update its documentation instead of providing a re-released patch. This decision has left many organizations vulnerable as they await a permanent solution.

Patch Status

Despite the severity of the vulnerability, AWS has not yet issued a definitive patch to resolve the issue. Instead, they have updated their documentation to clarify the functionality of Sandbox Mode. An AWS spokesperson acknowledged the report by researcher Kinnaird McQuade, thanking them for prompting the update. However, the lack of a robust fix raises concerns about the ongoing risk to users.

Organizations are encouraged to take proactive measures in response to this vulnerability. Experts advise migrating critical data from Sandbox mode to VPC mode and conducting thorough audits of IAM roles to enforce the principle of least privilege. These actions can help mitigate the risks associated with this vulnerability until a proper patch is implemented.

Immediate Actions

Organizations using AWS Bedrock should act swiftly to protect their data. Here are some recommended steps:

• Migrate critical data from Sandbox mode to VPC mode to enhance security.
• Audit IAM roles to ensure the principle of least privilege is enforced, minimizing access to sensitive data.
• Stay informed about updates from AWS regarding this vulnerability and any forthcoming patches.
• Consider implementing additional security measures, such as monitoring DNS queries for unusual activity.

By taking these actions, organizations can better safeguard their data against potential exploitation through this vulnerability in AWS Bedrock.