Researchers Find Data Leak Risk in AWS Bedrock AI Code Interpreter

Researchers at Phantom Labs disclosed a DNS-based vulnerability in AWS Bedrock AgentCore Code Interpreter’s sandbox that allows attackers to smuggle commands and exfiltrate data via DNS A/AAAA queries (a two-way DNS C2 using chunked ASCII in A records). The report includes a proof-of-concept, a 7.5/10 severity rating, a disclosure timeline in which AWS released and then rolled back a fix and ultimately updated documentation instead of patching, and recommended mitigations such as migrating instances to VPC mode and enforcing least-privilege IAM.