Cybersecurity researchers have revealed details of a new method for extracting sensitive data from artificial intelligence (AI) code execution environments using domain name system (DNS) queries. In a report published on Monday, BeyondTrust revealed that the sandbox feature of the Amazon Bedrock AgentCore Code Interpreter allows outbound DNS queries, which an attacker can exploit to launch interactive shells and bypass network isolation.
See also: AWS Bedrock's 'isolated' sandbox comes with a DNS egress
The issue, which does not have a CVE identifier, has a CVSS score of 7.5 out of 10.0. Amazon Bedrock AgentCore Code Interpreter is a fully managed service that allows AI agents to run code securely in isolated sandbox environments, ensuring that their jobs cannot access external systems.
It was released by Amazon in August 2025. The fact that the service allows DNS queries despite the “no network access” setting can allow “malicious actors to establish command and control channels and extract data over DNS in certain scenarios, bypassing expected network isolation checks,” said Kinnaird McQuade, security architect at BeyondTrust.
In an experimental attack scenario, a malicious actor could exploit this behavior to create a bidirectional communication channel using DNS queries and responses, obtain an interactive reverse shell, exfiltrate sensitive information via DNS queries if their IAM role has access permissions to AWS resources such as S3 buckets storing that data, and execute commands.
See also: Amazon Prime Video: Price increase on the ad-free plan
Additionally, the DNS communication mechanism can be exploited to deliver additional payloads fed to the Code Interpreter, causing it to check the command and control DNS server (C2) for commands stored in DNS A records, execute them and return the results via DNS subdomain queries. It is worth noting that the Code Interpreter requires an IAM role to access AWS resources.
However, a simple oversight can cause the service to be assigned an overly privileged role, granting it broad access permissions to sensitive data. “This research demonstrates how DNS resolution can undermine the network isolation guarantees of sandboxed code interpreters,” BeyondTrust said.
After responsible disclosure in September 2025, Amazon classified it as an intended feature rather than a bug, urging customers to use the VPC function instead of the sandbox function for full network isolation. The tech giant also recommends using a DNS firewall to filter outgoing DNS traffic.
The revelation comes as Miggo Security uncovered a serious security vulnerability in LangSmith (CVE-2026-25750, CVSS score: 8.5) that exposed users to potential token theft and account takeover.
See also: UNC6426: Exploited nx npm supply chain for AWS admin access
The issue, which affects both self-hosted and cloud deployments, has been addressed in version 0.12.71 released in December 2025. The vulnerability is characterized as a URL parameter injection issue resulting from a lack of validation in the baseUrl, allowing an attacker to exploit the vulnerability.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
