Monday,
May 18, 2026

🥖 Palette Cleanser

A working guest-to-host QEMU escape exploit dropped this week, chaining bugs in an experimental memory-device emulation feature to pop a shell on the hypervisor. QEMU is the open-source virtualization stack behind a lot of non-hyperscaler clouds and on-prem KVM, so the headline reads scary, but the buggy feature is off by default and no cloud provider exposes it to tenants (I think?). AWS shops get a free pass on this one, but it's one more entry in a pretty wild fortnight of public exploit drops.

Have feedback about AWS Security Digest? Tell us here. This issue is also available to share online.

📋 Chef's selections

  • Authorization Bypass in Amazon Quick: Unauthorized AI Chat Agent Usage by Jason Kao

    Jason found a missing server-side authorization check in Amazon Quick's (formerly QuickSight) Chat Agent API. Custom permissions could deny AI Chat Agent access in the UI, but direct API requests still worked, bypassing the admin restriction entirely. It was reported March 4, fixed silently March 11-12, with no AWS advisory or customer notification. I really don't like when AWS pretends like nothing happened when it comes to security bugs. The Register took them to task.

  • The AWS AI Security Framework: Securing AI with the right controls, at the right layers, at the right phases by Riggs Goodman III and Christopher Rae

    Most AWS content these days reads like it was written by AI. This isn't any different but the framework they present is actaully useful if you're trying to understand how you should think about security of AI. The defense-in-depth walkthrough stacks 10 separate controls on a single prompt injection scenario, capped by Bedrock's Automated Reasoning Checks which they claim deliver up to 99% verification accuracy against hallucinations. Buy that number or not, the idea that formal methods verify responses are logically derivable from approved knowledge bases is pretty neat.

  • Malicious Coding Agent Skills and the Risk of Dynamic Context by Nick Frichette and Ryan Simon

    This is fun. Claude Code skills support dynamic context with the ! syntax which runs shell commands before the rendered skill content reaches the model. That means model-level prompt injection defenses never get a chance to intervene. A cloned repo can carry skills into a trusted Claude Code session even if the developer never installed one from a marketplace. Skills load from managed policy, the user directory, the project .claude/skills/, plugins, nested project folders, or added directories. Anyone running Claude Code with AWS keys should read this.

🥗 AWS security blogs

🍛 Reddit threads on r/aws

    No threads this week.

💸 Sponsor shoutout

Pleri logo

Meet Pleri: your AI security engineer. She’s not a chatbot. Pleri proactively finds meaningful security work and fixes issues before they become problems.

Learn more about Pleri and see her in action.

🤖 Dessert

Dessert is made by robots, for those that enjoy the industrial content.

🧁 IAM permission changes

🍪 API changes

🍹 IAM managed policy changes

☕ CloudFormation resource changes

    No resource updates this week.

🎮 Amazon Linux vulnerabilities

📺 AWS security bulletins

🚬 Security documentation changes

YouTube Twitter LinkedIn

Crafted with ❤️ by Plerion. We simplify cloud security.