Monday,
April 20, 2026

🥖 Palette Cleanser

Last week I joined the chrous of folks screaming fire about Mythos. This week I'm going to pour some water over it. Davi Ottenheimer wrote a scathing takedown of Mythos and the Anthropic marketing of it. His main points are that the press-release "thousands of zero-days" number doesn't actually appear anywhere in the 244-page system card in reference to vulnerabilities, there is no CVE list or severity breakdown, and the flagship Firefox demo ran against a sandboxless harness using vulns handed over from Claude Opus 4.6 rather than anything Mythos found on its own. Strip the top two bugs out of that test set and the reported success rate drops from 72.4% to 4.4%. Also, an open-weight 3.6B active parameters model reproduced one of the showcased FreeBSD finds for just eleven cents per million tokens. Look, I haven't yet read the system card or used Mythos but I did read Davi's post and I'm definitely not taking this marketing stuff at face value. Not yet anyway.

Have feedback about AWS Security Digest? Tell us here. This issue is also available to share online.

📋 Chef's selections

  • Part 2 - CVE-2026-5429 AWS Kiro WebView XSS to Remote Code Execution by Dhiraj Mishra

    Kiro, AWS's VS Code agentic IDE, drops the workbench.colorTheme string into an inline script tag with no escaping and no Content Security Policy, so a malicious theme extension checked into a repo's .vscode/ folder runs arbitrary JavaScript in the Kiro webview the moment the project is opened. From there, the webview exposes a subprocess message handler that shells out, chaining theme-label XSS into full command execution as the developer. It's Dhiraj's second Kiro-to-RCE after the unquoted-workspace-path command injection in Part 1, and workspace-settings-as-attack-surface looks like a pattern worth watching.

  • The Invisible Footprint: How Anonymous S3 Requests Evade AWS Logging by Maya Parizer

    Maya found that anonymous S3 requests from inside a VPC to an external bucket produced no CloudTrail event in the caller's account, whether the endpoint policy allowed the call or denied it. No management event, no data event, no Network Activity event on the caller side, so a compromised workload could quietly reach out to an attacker-owned bucket with nothing in its own CloudTrail mentioning it. AWS has since patched it to emit Network Activity events for these calls, and the writeup pairs nicely with the earlier VPC endpoint account-ID leak research for a full tour of how invisible this path used to be.

🥗 AWS security blogs

🍛 Reddit threads on r/aws

    No threads this week.

💸 Sponsor shoutout

Pleri logo

Meet Pleri: your AI security engineer. She’s not a chatbot. Pleri proactively finds meaningful security work and fixes issues before they become problems.

Learn more about Pleri and see her in action.

🤖 Dessert

Dessert is made by robots, for those that enjoy the industrial content.

🧁 IAM permission changes

🍪 API changes

🍹 IAM managed policy changes

☕ CloudFormation resource changes

🎮 Amazon Linux vulnerabilities

📺 AWS security bulletins

🚬 Security documentation changes

YouTube Twitter LinkedIn

Crafted with ❤️ by Plerion. We simplify cloud security.