Capability Overview
AWS has launched autonomous agents within Amazon Quick, its enterprise AI assistant platform. These agents execute tasks continuously in the background — flagging CRM deals, drafting emails, summarising regulatory changes, and processing purchase orders — without requiring user intervention. Agents can be created in plain language with no coding, configured with variable autonomy levels (from step-by-step instruction to open-ended goal pursuit), and connected to a growing ecosystem of 16+ new integrations including Adobe, Cisco Webex, and an unspecified range of CRM and productivity tools. An integrated activity feed consolidates email, calendar, messaging, and task data into a single prioritised view and can act on behalf of users — replying, forwarding, approving, and delegating — across applications.
For defenders, this represents a qualitative shift: AI agents are no longer session-bound assistants but persistent, credentialed actors with write access to business-critical systems around the clock.
Attack Surface Analysis
The core security problem with continuously running, high-autonomy agents is that the blast radius of any single compromise expands dramatically. Previously, an attacker needed to persist across a user’s session to cause ongoing harm. With Amazon Quick agents, a one-time account compromise or a single successful prompt injection can yield persistent automation operating indefinitely with the victim’s credentials.
Prompt injection via monitored inputs is the highest-priority vector. Agents that monitor legislative feeds, email inboxes, or CRM records will inevitably process attacker-controlled content. A malicious supplier embedding instructions in an invoice, or a threat actor crafting a regulatory document, could redirect an agent’s actions — updating CRM records with false data, exfiltrating meeting notes to an external address, or suppressing flagged compliance alerts.
Excessive agency is structurally baked in by design. The platform explicitly offers ‘broad goals where agents figure out the path on their own.’ This is exactly the condition under which agents are most vulnerable to goal misguidance and least likely to be constrained by explicit guardrails.
The low-code creation surface lowers the barrier for insider threat: a disgruntled or compromised employee can spawn a persistent background agent in minutes, with minimal distinguishable audit trail compared to conventional automation tooling.
Pre-configured agent templates introduce a supply chain risk analogous to malicious npm packages — a poisoned or compromised template distributed at scale could embed persistent malicious instruction sets across all adopting organisations.
Cross-application lateral movement is now trivially achievable for any attacker who compromises a Quick account. With 16+ integrations spanning communications, documents, and CRM, a single pivot point yields access to an organisation’s full operational data layer.
Framework Mapping
- AML.T0051 (Prompt Injection) and LLM01: Primary risk given agents consume untrusted external content continuously.
- LLM08 (Excessive Agency) and AML.T0047: Agents with open-ended goals and write access to multiple systems are a textbook excessive agency scenario.
- AML.T0010 / LLM05 (Supply Chain): Pre-built agent library creates a centralised distribution risk for malicious templates.
- AML.T0012 (Valid Accounts): Compromised Quick credentials grant persistent, broad operational access.
- AML.T0057 / LLM06 (Data Leakage): Agents with read access across email, calendar, CRM, and documents can be weaponised for bulk exfiltration.
- AML.T0031 (Erode ML Model Integrity): Feedback loops where ’every correction makes agents better’ can be poisoned by adversarial correction inputs.
Threat Scenarios
Scenario 1 — Regulatory Feed Injection: A threat actor publishes a malicious ‘compliance update’ to a monitored legislative feed. The Quick agent processing it interprets embedded instructions, silently modifies impact summaries sent to executives, and suppresses genuine alerts — undermining compliance posture while appearing to function normally.
Scenario 2 — CRM Poisoning via Supplier Email: An attacker sends a crafted email from a spoofed supplier address containing prompt injection payloads. The activity feed agent processes it, updates CRM deal stages incorrectly, and drafts outbound replies containing sensitive commercial terms to the attacker’s address.
Scenario 3 — Insider Shadow Agent: A departing employee creates a broad-goal agent in the final week of employment, configured to forward weekly sales pipeline summaries to an external webhook. Without proactive agent inventory auditing, this persists post-departure.
Defender Checklist
- Inventory all Quick agents as you would privileged service accounts; document their scope, integrations, and autonomy level
- Apply least-privilege integration scoping — deny write access to any integration not explicitly required for the agent’s stated purpose
- Mandate human-in-the-loop approval for any agent action touching financial, HR, compliance, or external communications systems
- Audit the pre-configured agent library before allowing template-based deployment; treat templates as untrusted third-party code
- Establish monitoring on agent activity feeds for anomalous output patterns, unexpected recipients, or deviations from baseline behaviour
- Include Quick agent credentials in your account compromise response playbooks and offboarding checklists
- Test agents against adversarial inputs in monitored data sources (email, feeds, documents) before production deployment