Amazon Bedrock AgentCore Sandbox DNS Escape
Date: 2025-09
Affected: Amazon Bedrock AgentCore Sandbox DNS Escape
Attack vector: data-exfiltration
Category: real-world
Severity: Medium

AgentCore Code Interpreter's "Sandbox" mode (advertised as "complete isolation") allows outbound DNS queries. Attackers can establish bidirectional C2 channels and exfiltrate data via DNS tunneling. AWS declined to fix, reclassifying as "intended functionality." Independently confirmed by Palo Alto Unit42.


Mitigations:

Architectural layers (MAESTRO):