AWS Security Digest

Monday,
April 13, 2026

🥖 Palette Cleanser

AWS made an oopsie this week by pushing a test IAM managed policy to production. Was it a human or an agent? Regardless, it was caught by IAM Trail. A new policy slipping through is relatively harmless, but it raises an uncomfortable question. What happens if an unattended change hits an existing, actively-used AWS managed policy?

It's time to keep an eye on AWS security bulletins for this line: "We thank Anthropic for reporting this concern to the AWS Vulnerability Disclosure Program." It appeared for the first time in bulletin 2026-015, and it's probably a Mythos find. All your security friends are likely headless chickening the Claude Mythos reveal and what it's found. It has already turned up thousands of vulnerabilities across major systems, including a 27-year-old flaw in OpenBSD and a 16-year-old FFmpeg bug that automated testing tools had hit five million times without ever catching. Through Project Glasswing, AWS is one of the launch partners with access to Mythos for scanning their own code, backed by $100M in usage credits and structured 90-day disclosure timelines. This may be the first Mythos-reported vulnerability to land in an AWS security bulletin. It won't be the last.

Have feedback about AWS Security Digest? Tell us here. This issue is also available to share online.

📋 Chef's selections

Escaping the AWS AgentCore Sandbox by Ori Hadad

AgentCore's Code Interpreter sandbox mode promises "complete isolation with no external access." Ori found that arbitrary DNS lookups sail right through network restrictions, opening a covert bidirectional channel for data exfiltration and C2. The microVM Metadata Service (MMDS) makes it worse: no session token enforcement (think IMDSv1 but for microVMs), so credentials are accessible directly from within the sandbox. In part two, Ori turns to the identity side and finds the AgentCore starter toolkit auto-creates IAM roles with wildcard permissions across every agent in the account - memory, runtimes, ECR repos, code interpreters. The toolkit is meant for dev and testing but one compromised agent can pull every other agent's container image, read their conversation history, and poison their memory. Ori calls it Agent God Mode.
notyet: AWS IAM Credential Revocation Gaps by Eduard Agavriloae

When you disable an access key during incident response, IAM takes roughly 4 seconds to propagate that change globally. Given admin-level starting permissions, notyet is a cheeky tool that polls every 0.5 seconds for identity state changes, detects a containment action, and responds before propagation completes - creating new roles, assuming them, provisioning new users with random names you can't pre-target, and rewriting any policies you tamper with. AWS has fixed it so a deactivated key can no longer create a new access key, but it can still perform other IAM actions during the window, so notyet pivots through a temporary role to mint a fresh identity instead. Nigel Sood collaborated on the red-blue testing, throwing nearly a dozen IR containment methods at it: inline policies, managed policies, permission boundaries, group membership, access key deactivation, role deletion, SSM runbooks - none stuck. The most reliable kill switch is an SCP, because a compromised identity in a member account simply cannot detach an Organizations-level policy.

🥗 AWS security blogs

🍛 Reddit threads on r/aws

No threads this week.

💸 Sponsor shoutout

Meet Pleri: your AI security engineer. She’s not a chatbot. Pleri proactively finds meaningful security work and fixes issues before they become problems.

Learn more about Pleri and see her in action.

🥖 Palette Cleanser

📋 Chef's selections

🥗 AWS security blogs

🍛 Reddit threads on r/aws

💸 Sponsor shoutout

🤖 Dessert

🧁 IAM permission changes

🍪 API changes

🍹 IAM managed policy changes

☕ CloudFormation resource changes

🎮 Amazon Linux vulnerabilities

📺 AWS security bulletins

🚬 Security documentation changes