Amazon Quick Bug Exposed AI Chat Agents to Users Blocked by Custom Permissions
ID: a3a756bc-26e6-5b8b-88bc-dfc2454ff117
STIX ID: report--a3a756bc-26e6-5b8b-88bc-dfc2454ff117
Feed Name: cybersecurityNews.com
Threat Score
**Amazon Quick authorization bypass:** Fog Security discovered a server-side authorization (CWE-862) flaw in Amazon Quick’s AI chat agents that allowed users blocked by UI/custom permission profiles to access the backend API and interact with enterprise-connected AI; the issue was disclosed to AWS via HackerOne and quietly patched in March 2026, with AWS stating no customer data was at risk.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.