Amazon Bedrock AgentCore

AWS Details Architecture to Reduce Prompt Injection Risks in AI Agents

AWS has introduced a new architecture designed to prevent compromised or manipulated AI agents from accessing data beyond user permissions. The approach relies on Amazon Bedrock AgentCore to shift authorization decisions from the agent itself to the underlying infrastructure and connected services. The core risk arises when agents receive broad credentials to query databases, repositories, and SaaS platforms, allowing potential prompt injection attacks to retrieve unauthorized information. In the proposed design, users authenticate via Amazon Cognito and receive JWT tokens containing attributes such as department or role. The AgentCore Runtime validates these tokens before executing any agent actions, rejecting requests that violate configured rules. For DynamoDB queries, temporary credentials are issued through AssumeRoleWithWebIdentity, with IAM policies enforcing strict access to authorized data partitions only.

AWS and Vercel Patch Critical Flaws in AI Agent Platforms Allowing Unauthorized Tool Execution

AWS and Vercel have addressed multiple critical vulnerabilities in their AI agent platforms that enabled unauthorized execution of tools without legitimate model approval. The issues, grouped under the CoreBreak pattern, allowed attackers to bypass AI authorization checks by injecting crafted tool calls that the infrastructure misinterpreted as model-approved actions. In AWS, CVE-2026-18830 affected the InvokeHarness API in Amazon Bedrock AgentCore, permitting authenticated users to trigger sensitive tools directly. Vercel faced two separate flaws tracked as CVE-2026-64650 and CVE-2026-64651 that let sandboxed code reach host system tools, potentially exposing secrets or cloud APIs. No public evidence of active exploitation has been confirmed yet. Organizations are advised to apply updates immediately, restrict available tools for agents, and treat all external inputs as potentially malicious.