whoAMI attack could allow remote code execution within AWS account

Datadog Security Labs disclosed a name‑confusion attack called whoAMI that allows an attacker to publish a malicious community AMI whose name causes it to be returned by automated AMI searches when victims omit owner filters; if selected, the AMI can execute arbitrary code in the victim's AWS account. The researchers produced a PoC with a backdoored AMI, estimate ~1% of organizations could be vulnerable at scale, and note that mitigations now exist (AWS Allowed AMIs and terraform/provider warnings).