AWS Warns Outbound Traffic Blind Spots Can Enable Cloud Data Exfiltration

This report summarizes an AWS advisory warning that default-open outbound traffic in cloud environments creates a blind spot that attackers can exploit to exfiltrate data—illustrated by CVE-2025-55182 (React2Shell), DNS tunneling, and risks from agentic AI agents. It recommends a layered egress control strategy (Route 53 Resolver DNS Firewall across VPCs, centralized network firewall and identity/access policies, endpoint restrictions, and automated response) to detect and block unauthorized outbound channels.