S3 Clones in the Neoclouds

by Scott Piper

Nebius, Crusoe, Vultr, Lambda Labs and DigitalOcean all rent GPUs, and all of them plus Cloudflare sell object storage you drive with the plain AWS CLI, just pointed at their endpoint with keys like Nebius's NAKI or Crusoe's CKIA instead of AKIA. Scott checked how much of your S3 knowledge survives the trip and the answer is not much, because on one clone get-bucket-policy returned a bucket listing dressed up as a policy and delete-bucket-policy deleted the bucket. Vultr, Crusoe and Lambda Labs cannot scope a key at all, so every key opens everything, and Vultr's API will hand back a secret that AWS would have shown you exactly once. Only Nebius and DigitalOcean log data plane events. I probably shouldn't get upset when AWS implements something inconsistently given how bad these things are at AWSifying stuff.

AgentCore or AgentSore: Cross-Agent Privilege Escalation in Bedrock AgentCore

by Kennedy Torkura

Ori Hadad at Unit 42 published this in April and called it Agent God Mode. The Bedrock AgentCore starter toolkit auto-generates an execution role with wildcard resource scopes, so any agent can pull any other agent's container image, read or poison any other agent's memory, and invoke any interpreter or runtime in the account, the same wildcard habit I complained about in the old Bedrock Agents console builder last October, that time in the trust policy. Kennedy's post is openly a demo of Mitigant's attack emulation platform, which stands up a victim and an attacker agent, runs all four paths and tears it down in about four minutes, but the telemetry work is the reason to read it. AgentCore's data plane writes nothing to CloudTrail unless you enable Data Events, and even then the CreateEvent body arrives as HIDDEN_DUE_TO_SECURITY_REASONS, so you can prove someone wrote into another agent's memory but never see what they wrote.

A Security Analysis of Amazon S3 Vectors and Its Use in LLM Retrieval Pipelines

by Ioan Criste and Emanuel Ioniță

Amazon S3 Vectors adds a vector bucket type to S3 that stores embeddings and answers similarity queries, so a RAG pipeline like Bedrock Knowledge Bases can fetch context without running a separate vector database. The store itself held up under testing, but nothing checks what the metadata on a vector actually says, so anyone who already holds s3vectors:PutVectors can rewrite the chunk text an LLM reads and forge the citation metadata so the answer cites a real, unmodified PDF that says something else. In their own AWS account one planted vector had a clinical assistant recommending 4 grams of metformin a day, double the safe maximum, citing the untouched hospital formulary. AWS reviewed it and called it working as designed, which is fair, and also means your knowledge base is only as safe as whoever holds PutVectors or PutVectorBucketPolicy.