AWS Bedrock AgentCore Sandbox Bypass Enables Stealthy C2 and Data Exfiltration

A newly disclosed vulnerability in AWS Bedrock AgentCore Code Interpreter allows threat actors to bypass network isolation and establish stealthy command-and-control (C2) channels.

AWS originally advertised this mode as providing complete isolation without external access, researchers found that it permits outbound DNS queries for A and AAAA records.

This structural allowance enables attackers to exfiltrate sensitive cloud data and execute remote commands without triggering network restrictions. The security issue currently holds a CVSSv3 score of 7.5.

Discovered by BeyondTrust’s Phantom Labs and publicly detailed on March 16, 2026, the flaw resides in the service’s “Sandbox” network mode.

The Sandbox Escape Mechanism

The AWS Bedrock AgentCore Code Interpreter allows AI agents and chatbots to execute dynamic code, such as Python or shell scripts, on behalf of users.

While the Firecracker microVMs powering the service provide strong compute isolation, the network layer in Sandbox mode fails to restrict DNS traffic.

If an attacker achieves code execution inside the interpreter, through prompt injection, supply chain attacks, or malicious AI-generated code, they can exploit this oversight.

The attack works by polling an attacker-controlled DNS server. The malicious server sends commands back to the sandbox encoded as chunked ASCII values within the IP addresses of DNS A record responses.

The compromised Code Interpreter then executes these commands and exfiltrates the output by embedding base64-encoded chunks into DNS subdomain queries. This creates a reliable, bidirectional tunnel hidden entirely within standard DNS traffic.

The primary danger of this bypass is the ability to obtain a full interactive reverse shell within a supposedly isolated environment.

The blast radius significantly expands if the Code Interpreter is assigned an overprivileged AWS Identity and Access Management (IAM) role.

Researchers demonstrated that the interpreter’s IAM permissions can be abused to query and access other AWS services, such as S3 buckets or DynamoDB.

Using the established DNS C2 channel, an attacker can list storage buckets, read files, and exfiltrate sensitive information like personally identifiable information (PII), API keys, and financial data.

Because all data leaves the environment via DNS queries, traditional network monitoring tools looking for outbound HTTP or TCP connections will not detect the breach.

Mitigation and Security Recommendations

AWS ultimately chose not to patch the sandbox behavior, updating its documentation to state that Sandbox mode intentionally allows DNS resolution. Consequently, security teams must proactively secure their AI deployments.

Organizations should immediately inventory all active AgentCore Code Interpreter instances and evaluate their network configurations.

To achieve true network isolation, workloads handling sensitive data must be migrated to “VPC Mode”.

This configuration requires VPC endpoints and allows administrators to enforce strict network access control lists (ACLs) and Route53 DNS Firewalls.

Furthermore, administrators must enforce the principle of least privilege by ensuring the Code Interpreter’s IAM role only possesses the exact permissions necessary for its intended tasks, actively preventing access to sensitive S3 buckets or external databases.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.