AWS Bedrock AgentCore Sandbox Bypass Enables Stealthy C2 and Data Exfiltration

A disclosed sandbox escape in AWS Bedrock AgentCore Code Interpreter Sandbox mode allows outbound DNS resolution that attackers can abuse to establish a bidirectional DNS-based C2 channel and exfiltrate sensitive data (including PII and API keys). Researchers rated the issue CVSSv3 7.5 and demonstrated interactive shells and access to other AWS services when the interpreter has overprivileged IAM permissions; AWS declined to patch the behavior and recommends moving sensitive workloads to VPC Mode and enforcing least-privilege IAM roles.