Key points
- AWS Security Agent captured flags in 33 of 37 new CVEs, an 89.2 percent success rate.
- The agent operated from unauthenticated positions with only a URL and one-line hint.
- Targets included web frameworks, container registries, and machine learning platforms.
AWS Security Agent, now part of AWS Continuum, successfully exploited 33 of 37 recently disclosed Common Vulnerabilities and Exposures in a new internal benchmark. According to the AWS Security Blog, the agent operated on live, containerized targets without access to proof-of-concept code or exploit scripts. It started from unauthenticated or low-privilege positions, using only an endpoint URL and a single-line hint to discover and exploit the vulnerabilities end-to-end.
In plain English
The test measured how well an autonomous agent can find and exploit fresh security flaws. The agent had to discover the vulnerability, build a working exploit, and chain security primitives where necessary to extract a hidden flag. It succeeded in 89.2 percent of cases. Two captures were reclassified as off-path during an integrity audit, and two misses occurred when the agent crashed the target before retrieving the flag. These results were confirmed against canonical proof-of-concept files for each challenge.
The background
The benchmark targeted software types common in production environments, including web frameworks, container registries, machine learning platforms, and an LDAP admin console. The vulnerabilities spanned eight classes, from SQL injection to server-side request forgery and multi-step cross-site scripting chains. AWS stated that public benchmarks often suffer from data contamination, where models memorize solutions from training data. This new benchmark uses recently disclosed CVEs and disables runtime lookups to reduce that contamination risk.
What changes now
This test demonstrates that autonomous agents can exploit fresh vulnerabilities without prior training or public exploit code. The results suggest that the window for patching newly disclosed flaws is shrinking as AI tools become more capable. Organizations can no longer assume that a lack of public proof-of-concept code provides safety. The agent’s ability to chain primitives and operate from low-privilege positions indicates a shift toward more sophisticated, automated attack capabilities in the wild.
Who needs to act first
Teams should prioritize updating systems that face the internet, as these are most exposed to automated scanning. Check whether your web frameworks, API gateways, and container registries are running the latest versions. Roll out fixes after testing in isolated environments to ensure stability. Back up configurations before applying patches. If immediate patching is not possible, restrict access to vulnerable endpoints and monitor logs for unusual activity. Focus on assets that handle sensitive data or allow remote code execution.
What to do and how to stay safe: AWS Security Agent
- Inventory all systems running web frameworks, container registries, and machine learning platforms to identify exposure.
- Monitor vendor advisories for newly disclosed CVEs and apply patches as soon as they are available.
- Implement strict network segmentation to limit access to critical internal services from untrusted networks.
- Review logs for signs of automated exploitation attempts, such as rapid scanning or unusual API calls.
Step-by-step guide: Detect Leaked Cloud Access Keys Before Attackers Do
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the AWS Security Agent use proof-of-concept code to exploit these vulnerabilities?
No, the agent operated without proof-of-concept code or exploit scripts, starting only with an endpoint URL and a one-line hint.
How many vulnerabilities did the agent successfully exploit?
The agent successfully exploited 33 of 37 recently disclosed CVEs, achieving an 89.2 percent success rate.
What types of software were targeted in this benchmark?
Targets included web frameworks, container registries, machine learning platforms, ecommerce stacks, and an LDAP admin console.
