AWS’s promise of “complete isolation” for AI workflows in Bedrock is facing criticism after it was discovered that the sandbox feature is not as sealed as advertised. In a recent disclosure, BeyondTrust analyzed how the “Sandbox” feature in AWS Bedrock AgentCore’s Code Interpreter can be abused to breach isolation boundaries using DNS queries. While the sandbox blocks most outbound traffic, it still allows DNS queries for A and AAAA records, potentially allowing attackers to establish a secret communication channel, leading to data exfiltration and remote command execution.
See also: AWS data centers: Drone attacks caused extensive damage
BeyondTrust researchers said in a blog post that AWS acknowledged the report and reproduced the issue during the disclosure process, but ultimately chose not to fix the behavior, calling it “intended functionality rather than a defect.” The problem is that the sandbox environment allows outbound DNS queries, which can be manipulated to create a two-way communication channel between the AI agent and an external server controlled by attackers.
By encoding data in DNS queries and responses, BeyondTrust's Phantom Labs team demonstrated data extraction and even the installation of an interactive reverse shell, without triggering any network restrictions. " The (vulnerable) environment allows outbound DNS queries for A and AAAA records, a structurally permissible feature that malicious users can exploit to establish a two-way command and control channel ," said Jason Soroko , senior partner at Sectigo .
Once this channel is in place, the rest becomes a permissions issue. If the agent runs with overly permissive IAM roles, the blast radius expands quickly.
See also: Amazon Kiro AI: 13-hour outage on AWS due to bot error
“Using this channel, attackers can secure an interactive reverse shell and execute arbitrary commands,” Soroko added. “If the AI execution environment has overly permissive IAM roles, attackers can silently extract sensitive cloud data, such as S3 bucket contents, directly through these permissive DNS queries.”
Technically, the sandbox hasn’t been breached. It’s being bypassed using functionality that was always meant to be there. At least, that’s what AWS says. BeyondTrust said it discovered and reported the vulnerability to AWS on September 1, 2025, via the bug bounty platform HackerOne. AWS reportedly acknowledged receipt of the report and deployed an initial fix to production in November.
However, BeyondTrust was informed a few days later that the initial fix had been withdrawn due to “other factors” and that AWS was working on a more robust solution. Ultimately, in December, AWS told BeyondTrust that there would be no fix as the behavior was an “intended functionality” and instead updated their documentation to clarify that Sandbox mode allows DNS resolution.
See also: Software supply chain risks added to OWASP Top 10 list
The BeyondTrust researcher received a $100 gift card to the AWS Gear Shop for the discovery. An AWS spokesperson told CSO that all AWS services and infrastructure are functioning as expected.
