Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-03-19 · source-backed
BeyondTrust's Phantom Labs disclosed on March 16 that AWS Bedrock AgentCore's Code Interpreter Sandbox — the environment where your agents execute code — permits outbound DNS queries with no restriction. This isn't a theoretical vulnerability. The researchers demonstrated a complete attack chain: commands sent to the agent via DNS A-record IP responses (encoded as chunked ASCII), output exfiltrated via base64-encoded DNS subdomain queries. A full covert C2 channel inside your "sandboxed" agent runtime. BeyondTrust Phantom Labs
The CVSS score is 7.5. AWS's response was to update documentation, calling DNS resolution "intended functionality," and decline to patch. Every Bedrock AgentCore user running Code Interpreter today is exposed. PII, API keys, financial data — anything your agent can access in its execution context can be exfiltrated through DNS without triggering any application-layer security monitoring.
The defense is straightforward but requires infrastructure work: isolate agent execution environments from IMDS (the Instance Metadata Service at [redacted]), apply egress filtering to block all DNS traffic except to your controlled resolvers, and monitor DNS query patterns for anomalous subdomain lengths and encoding signatures. If you're running agents in Bedrock AgentCore with access to sensitive data and haven't implemented DNS egress controls, you have an open exfiltration channel right now.
This finding converges with two other agent security disclosures today — the MCPwned Azure MCP SSRF chain and the Excel Copilot zero-click exfiltration — painting a picture of agent infrastructure that was built for capability before security caught up.
Each link below shares sources, entities, or timing with this story.
AWS Bedrock AgentCore built by AWS / Shared entities / Same source / Shared topic
Linked by a graph relationship (AWS Bedrock AgentCore built by AWS); both cover AWS, Bedrock AgentCore, DNS, IMDS; cite the same source (BeyondTrust Phantom Labs).
AWS released Amazon Bedrock AgentCore / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (AWS released Amazon Bedrock AgentCore); both cover Bedrock AgentCore, Code Interpreter, DNS; overlapping topics (agentcore, bedrock, code, data, execution).
AWS Bedrock AgentCore built by AWS / Shared entities / Shared topic / What happened next
Linked by a graph relationship (AWS Bedrock AgentCore built by AWS); both cover AWS, Bedrock AgentCore; overlapping topics (agent, agentcore, bedrock, code).
AWS Bedrock AgentCore built by AWS / Shared entities / Shared topic / What happened next / Tension
Linked by a graph relationship (AWS Bedrock AgentCore built by AWS); both cover AWS, Bedrock AgentCore; overlapping topics (agent, agentcore, bedrock).
AWS Bedrock AgentCore built by AWS / Shared entities / Shared topic / What happened next
Linked by a graph relationship (AWS Bedrock AgentCore built by AWS); both cover AWS, March; overlapping topics (agent, chain, environment).
Linked by a graph relationship (AWS Bedrock AgentCore built by AWS); both cover AWS, DNS; overlapping topics (agent, code).
AWS Bedrock AgentCore built by AWS / Shared entity: AWS / Shared topic / Earlier coverage
Linked by a graph relationship (AWS Bedrock AgentCore built by AWS); both cover AWS; overlapping topics (access, agent, agentcore, bedrock, code).
AWS Bedrock AgentCore built by AWS / Shared entity: AWS / Shared topic / What happened next / Tension
Linked by a graph relationship (AWS Bedrock AgentCore built by AWS); both cover AWS; overlapping topics (agent, code).