AWS Bedrock AgentCore Sandbox Escape via DNS Tunneling and Metadata Service Exploitation
AWS Bedrock AgentCore Sandbox Escape via DNS Tunneling and (TL-2026-0331), also tracked as Cracks in the Bedrock, is a high-severity cloud security threat, first published 2026-04-07. It has no confirmed attribution, affects Amazon Web Services Amazon Bedrock AgentCore, maps to 11 MITRE ATT&CK techniques (T1048, T1059, T1071), and is covered by 9 detection rules and 15 indicators of compromise.
Key facts for TL-2026-0331
- Threat ID
- TL-2026-0331
- Also known as
- Cracks in the Bedrock, AgentCore Sandbox Escape
- Severity
- HIGH
- Status
- MONITORING
- Category
- CLOUD
- First published
- 2026-04-07
- Last reviewed
- 2026-04-07
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, financial, healthcare, government, cloud-services, artificial-intelligence
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 15
Unit 42 researchers discovered critical weaknesses in Amazon Bedrock AgentCore's Sandbox Mode isolation that enable DNS tunneling for bidirectional data exfiltration and C2 communication, legacy MMDSv1 exploitation for IAM credential theft, and infrastructure information disclosure including pre-signed S3 URLs and KMS Key IDs. AWS enforced MMDSv2 defaults for new agents on February 14, 2026, but legacy agents remain vulnerable unless manually updated.
How AWS Bedrock AgentCore Sandbox Escape via DNS Tunneling and works
Unit 42 researcher Ori Hadad discovered multiple sandbox isolation bypasses in Amazon Bedrock AgentCore's Code Interpreter running in Sandbox Mode. The vulnerabilities chain together to defeat the sandbox's core isolation promise of "no external network access."
**DNS Tunneling Bypass (Primary Vector)**
Despite AgentCore's Sandbox Mode documentation claiming no external network access, the sandbox permitted DNS resolution to arbitrary external domains. Researchers demonstrated this by resolving both internal AWS services (s3.us-east-1.amazonaws.com) and external domains (google.com) from within the sandbox using Python's socket.gethostbyname_ex() function.
This DNS resolution capability was weaponized into a full bidirectional covert channel. By encoding sensitive data as subdomains of an attacker-controlled domain (e.g., base64-encoded-secret.dnshook.site), the sandbox's internal DNS resolver would recursively forward queries to the attacker's authoritative nameserver, effectively exfiltrating data encoded in DNS query labels. The reverse channel enables command-and-control by embedding instructions in DNS response records.
**MicroVM Metadata Service (MMDS) Exploitation**
The AgentCore sandbox runs on Firecracker microVMs, each with an ephemeral per-session lifecycle. The microVM's metadata service endpoint at 169.254.169.254 was configured with legacy MMDSv1 behavior — accepting standard HTTP GET requests without requiring a session token. This contrasts with EC2's IMDSv2 which mandates a PUT-based token exchange before metadata access.
This misconfiguration allowed direct retrieval of temporary IAM role credentials (Access Key ID, Secret Access Key, and Session Token) associated with the sandbox execution context. Combined with the DNS tunneling channel, these credentials could be exfiltrated to an attacker-controlled server.
**Infrastructure Information Disclosure**
Researchers discovered undocumented MMDS tag endpoints that exposed operational infrastructure details: - http://169.254.169.254/latest/meta-data/tags/instance/aws_presigned-log-url returned pre-signed S3 URLs with scoped write access to internal AWS logging buckets - http://169.254.169.254/latest/meta-data/tags/instance/aws_presigned-log-kms-key revealed KMS Key IDs used for backend infrastructure encryption
Additionally, malformed S3 requests triggered error responses containing the AWSAccessKeyID of the signing identity (beginning with ASI...X6L) and the owning AWS account number (209...9), enabling infrastructure reconnaissance.
**Attack Chain**
The complete exploitation chain proceeds as follows: (1) Confirm DNS resolution capability from sandbox, (2) Enumerate MMDS endpoints to harvest IAM credentials and infrastructure metadata, (3) Establish DNS tunneling channel to attacker-controlled nameserver, (4) Exfiltrate stolen credentials and infrastructure details via DNS subdomain encoding, (5) Use exfiltrated credentials externally for lateral movement within the victim's AWS environment.
**Sandbox Mode vs VPC Mode**
AWS Bedrock AgentCore offers two network isolation modes. Sandbox Mode provides limited isolation with DNS access and S3 connectivity for logging. VPC Mode deploys into customer-controlled subnets with full network control including Route 53 Resolver DNS Firewall capability. Unit 42 recommends VPC Mode for production and sensitive workloads.
**Remediation**
AWS responded by enforcing MMDSv2 as the default for all new AgentCore agents as of February 14, 2026, and providing an API option for customers to disable IMDSv1 on existing agents. AWS also updated documentation to more accurately describe Sandbox Mode's network capabilities as "limited external network access" rather than implying complete isolation.
MITRE ATT&CK techniques used in TL-2026-0331
exfiltration
T1048 Exfiltration Over Alternative Protocol
execution
T1059 Command and Scripting Interpreter
command-and-control
T1071 Application Layer Protocol; T1572 Protocol Tunneling
defense-evasion
discovery
T1082 System Information Discovery; T1580 Cloud Infrastructure Discovery; T1619 Cloud Storage Object Discovery
initial-access
T1190 Exploit Public-Facing Application
collection
credential-access
Affected products and versions in AWS Bedrock AgentCore Sandbox Escape via DNS Tunneling and
- Amazon Web Services — Amazon Bedrock AgentCore
Vulnerable versions: All Sandbox Mode deployments prior to February 14, 2026; Legacy agents without IMDSv1 disabled
Fixed in: New agents created after February 14, 2026 (MMDSv2 default); Agents with IMDSv1 manually disabled via API - Amazon Web Services — Amazon Bedrock Code Interpreter
Vulnerable versions: Sandbox Mode (pre-Feb 14, 2026)
Fixed in: VPC Mode; Sandbox Mode with MMDSv2 enforced - Amazon Web Services — Amazon Bedrock Browser Tool
Vulnerable versions: Sandbox Mode (pre-Feb 14, 2026)
Fixed in: VPC Mode; Sandbox Mode with MMDSv2 enforced
Remediation for AWS Bedrock AgentCore Sandbox Escape via DNS Tunneling and
Patches
- AWS enforced MMDSv2 as default for new AgentCore agents (February 14, 2026)
- AWS provided API to disable IMDSv1 on legacy agents — apply immediately
- AWS updated Sandbox Mode documentation to clarify limited network access
Immediate actions
- Disable IMDSv1 on all existing Bedrock AgentCore agents via AWS API
- Migrate AgentCore deployments from Sandbox Mode to VPC Mode
- Implement Route 53 Resolver DNS Firewall rules in VPC Mode to block unauthorized DNS resolution
- Audit IAM roles attached to AgentCore Code Interpreter for least privilege compliance
- Review CloudTrail logs for anomalous STS or metadata service access from AgentCore execution contexts
Workarounds
- Use VPC Mode instead of Sandbox Mode for all sensitive workloads
- Apply restrictive security group and NACL rules to AgentCore VPC subnets
- Monitor DNS query logs from AgentCore execution environments for data exfiltration indicators
Longer-term hardening
- Deploy all AgentCore workloads in VPC Mode with DNS firewall policies
- Implement network-level DNS monitoring for tunneling indicators (high-entropy subdomain queries, unusual query volumes)
- Establish guardrails for AI agent code execution environments with defense-in-depth isolation
- Integrate cloud workload protection platforms (CWPP) for runtime monitoring of serverless and microVM environments
- Conduct periodic red team assessments of AI agent sandbox isolation boundaries
Weaknesses (CWE) in AWS Bedrock AgentCore Sandbox Escape via DNS Tunneling and
CWE-918, CWE-200, CWE-269, CWE-668
Timeline of AWS Bedrock AgentCore Sandbox Escape via DNS Tunneling and
- Unit 42 researcher Ori Hadad responsibly disclosed DNS tunneling, MMDS exploitation, and infrastructure disclosure vulnerabilities in AWS Bedrock AgentCore Sandbox Mode to AWS Security
- AWS Security acknowledged the disclosure and began internal investigation into AgentCore sandbox isolation weaknesses
- AWS requested additional technical details from Unit 42 researchers regarding the DNS tunneling and metadata service exploitation vectors
- AWS provided remediation commitments including MMDSv2 enforcement and API controls for disabling IMDSv1 on existing agents
- AWS enforced MMDSv2 as default for all new Bedrock AgentCore agents, mitigating the metadata service credential theft vector for new deployments
- Unit 42 published full technical writeup with PoC details and remediation guidance titled Cracks in the Bedrock: Escaping the AWS AgentCore Sandbox
- As of 2026-05-29, this remains live: AWS deemed the Sandbox-Mode DNS tunneling/C2 vector "intended functionality" and won't patch it (mitigation needs customer VPC Mode + DNS Firewall), and legacy MMDSv1 agents stay credential-exposed despite the Feb 14 2026 MMDSv2 default for new agents. It is an unattributed public PoC with no reported in-the-wild abuse, so MONITORING fits.
Sources cited for AWS Bedrock AgentCore Sandbox Escape via DNS Tunneling and
- Cracks in the Bedrock: Escaping the AWS AgentCore Sandbox
- Amazon Bedrock AgentCore Documentation - Network Isolation
- AWS Instance Metadata Service Version 2 (IMDSv2) Documentation
- MITRE ATT&CK T1552.005 - Unsecured Credentials: Cloud Instance Metadata API
- MITRE ATT&CK T1071.004 - Application Layer Protocol: DNS
- AWS Firecracker MicroVM Security Overview
- AWS Route 53 Resolver DNS Firewall Documentation
- Unit 42 - Palo Alto Networks Threat Research
Threats related to AWS Bedrock AgentCore Sandbox Escape via DNS Tunneling and
Detection coverage for TL-2026-0331
As of 2026-04-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0331 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.