Amazon Quick Security Flaw Allowed Restricted Users to Access AI Chat Agents

A newly disclosed security flaw in Amazon’s AI-powered business intelligence platform has revealed how restricted users could quietly bypass controls and interact with AI chat agents, despite explicit administrative denial.

The issue, discovered by Fog Security researcher Jason Kao, exposes a critical gap between user interface restrictions and backend enforcement in modern AI-integrated cloud services.

Amazon Quick Security Flaw

The vulnerability stemmed from missing server-side authorization checks in Amazon Quick’s Chat Agent API. While administrators could restrict AI chat access via custom permission settings, those restrictions were enforced only in the user interface, not at the API level.

By sending direct HTTP requests to backend endpoints, users could still interact with AI chat agents without triggering any access control violations. In simple terms, the system appeared locked from the outside, but the backend door remained open.

For example, a restricted user could send a request like a basic prompt, “Tell me about mangoes”, and receive a valid AI-generated response, even though all AI chat capabilities were supposedly disabled for that account.

Security researchers classify this type of flaw as CWE-862, or missing authorisation, a well-known issue in which systems fail to validate permissions on the server side properly.

The flaw did not allow cross-account or cross-tenant access, preventing attackers from breaking into other organizations.

However, it did allow users within the same account to bypass administrative controls, controls often relied upon for governance, compliance, and the prevention of unauthorized AI use.

Amazon Quick, formerly known as QuickSight and now part of the broader “Quick Suite,” is widely used as an enterprise SaaS platform. It integrates with services like Slack, Microsoft Teams, CRMs, and internal databases, enabling AI agents to analyze and act on business data.

Organizations often turn off such AI features to prevent risks like:

• Unauthorized data exposure
• Shadow AI usage
• Regulatory compliance violations

This vulnerability effectively undermined those safeguards.

Compounding the issue, AWS automatically provisions a default AI chat agent when the service is activated. This increases the attack surface, even in environments where administrators intend to turn off AI functionality fully.

Fog Security reported the issue to AWS on March 4, 2026, through its vulnerability disclosure program on HackerOne. AWS responded بسرعة, deploying fixes in initial regions by March 11 and completing a global rollout by March 12.

BURP Request Before Fix Showing Succesful Interaction with AI Chat Agent

After the fix, unauthorized API requests began returning a proper 401401 Unauthorized response, indicating that server-side checks were finally enforced.

However, AWS classified the vulnerability as “none” in severity and did not issue any public advisory or customer notification. This decision has raised concerns among security professionals, especially given that the flaw bypassed explicit administrative restrictions.

Fragmented Access Control

A key factor behind the issue lies in how Amazon Quick handles access management. Unlike most AWS services, which rely on AWS Identity and Access Management (IAM), Quick uses a separate “custom permissions” system.

This creates inconsistencies:

• IAM policies and Service Control Policies (SCPs) cannot restrict AI chat agents
• Only Quick-specific custom permissions apply
• Backend APIs initially ignored these custom permissions entirely

This fragmented model increases the risk of misconfigurations and enforcement gaps.

This incident highlights a growing challenge in cloud and AI security: ensuring that access controls are consistently enforced across both UI and API layers.

As organizations rapidly adopt AI-powered tools, security mechanisms must evolve just as quickly. A control that operates only at the interface level is not sufficient, especially when APIs can be accessed directly.

An AWS spokesperson told GBHackers that “this issue was addressed in March 2026. No customer data was at risk, and there is no customer action required. As always, customers can contact AWS Support with any questions or concerns about the security of their account.”

Even though AWS has fixed the issue, the lack of transparency and public disclosure may leave customers unaware that their controls were previously ineffective.

The case serves as a reminder that in AI-driven platforms, security assumptions should always be tested beyond the surface.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.