XM Cyber Finds 8 Attack Vectors in AWS Bedrock
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- XM Cyber's threat research team identified 8 validated attack vectors in AWS Bedrock spanning log manipulation, knowledge base compromise, agent hijacking, flow injection, guardrail degradation, and prompt poisoning.
- Bedrock model invocation logs can be silently exfiltrated to attacker-controlled S3 buckets via bedrock:PutModelInvocationLoggingConfiguration, or scrubbed using s3:DeleteObject or logs:DeleteLogStream to eliminate forensic evidence of jailbreaking activity.
- Bedrock Knowledge Bases connect directly to enterprise data sources (S3, Salesforce, SharePoint, Confluence), and attackers stealing SaaS connection credentials could move laterally into Active Directory through SharePoint integrations.
- Bedrock Agents can be hijacked using bedrock:UpdateAgent or bedrock:CreateAgentActionGroup permissions to rewrite base prompts, leak internal instructions and tool schemas, or attach malicious executors that perform unauthorized actions like database modifications.
- Bedrock Guardrails — the platform's primary defense layer for filtering toxic content and blocking prompt injection — can be weakened via bedrock:UpdateGuardrail (lowering thresholds or removing topic restrictions) or removed entirely via bedrock:DeleteGuardrail.
- Bedrock Prompt Management templates can be poisoned via bedrock:UpdatePrompt without triggering application redeployment, allowing attackers to alter AI behavior "in-flight" and evade traditional application monitoring tools.
- The research, authored by XM Cyber Security Researcher Eli Shparaga, concludes that attackers target the permissions, configurations, and integrations surrounding the model — not the model itself — meaning a single over-privileged identity is enough to reach critical on-premises systems from a Bedrock foothold.
Why it matters: For security teams deploying AI agents, the model itself is the least of their worries: the permissions, data connections, and configuration tools wrapping Bedrock are the real attack surface. A single over-privileged identity can pivot from Bedrock into SharePoint, Active Directory, or customer databases — turning a foundation model deployment into a direct path to on-premises systems.
