We Found Eight Attack Vectors Inside AWS Bedrock. Here's What Attackers Can Do with Them

XM Cyber's threat research team identified eight validated attack vectors targeting AWS Bedrock's permissions, configurations, and integrations.

• •Model Invocation Log Attacks: attackers can redirect logs to an attacker-controlled S3 bucket or delete log streams to erase forensic evidence of jailbreaking
• •Knowledge Base Data Source Attacks: s3:GetObject access enables raw data exfiltration; stolen SaaS credentials (e.g., SharePoint) can enable lateral movement into Active Directory
• •Knowledge Base Data Store Attacks: API keys and credentials from Pinecone, Redis, Aurora, or Redshift can grant full administrative access to vector indices or structured data
• •Agent Attacks (Direct): bedrock:UpdateAgent allows rewriting an agent's base prompt; bedrock:CreateAgentActionGroup enables attaching malicious executors to legitimate agents