Amazon-Bedrock

AWS Adds Agentic Observability via OpenSearch Service MCP Apps

FIRST LOOK ATLAS OWASP MEDIUM ▲ 5.5 AWS Machine Learning Blog Aug 26, 2026

AWS has released agentic observability tooling through Amazon OpenSearch Service MCP Apps, providing structured visibility into the actions, tool invocations, and decision traces of AI agents running on AWS infrastructure. This closes a meaningful gap for defenders who previously lacked native, queryable telemetry over agent behaviour — a prerequisite for detecting anomalous tool use, privilege escalation patterns, and unexpected data access in agentic pipelines. Realising the full defensive value will require mature logging schemas, tuned detection rules, and integration with existing SIEM or SOAR tooling that most organisations are still building.

AWS Launches AgentCore Gateway for AI Agent Tool Access Control

FIRST LOOK ATLAS OWASP MEDIUM ▲ 7.2 AWS Machine Learning Blog Aug 24, 2026

Amazon Bedrock AgentCore Gateway introduces centralised governance controls for AI agent tool access, enabling organisations to define, enforce, and audit which tools agents can invoke at runtime. This closes a meaningful gap for defenders who previously lacked a managed plane to govern agentic tool permissions at scale, reducing the risk of excessive agency and uncontrolled lateral tool invocation. Realising the full benefit will require organisations to mature their agent inventory practices and integrate Gateway policies with existing IAM and SIEM workflows.

Anthropic Claude Opus 4.6 Reveals Persistent Jailbreak Gaps in API

FIRST LOOK ATLAS OWASP MEDIUM ▲ 5.5 TechCrunch AI Aug 23, 2026

TechCrunch testing and an independent researcher have demonstrated that Anthropic's Claude Opus 4.6, Opus 3, and Haiku 4.5 models — all still available via the Anthropic API, Azure Foundry, and Amazon Bedrock — can be reliably coaxed into generating sexually explicit content through a multi-turn social engineering technique, despite Anthropic's universal usage policies prohibiting such output. The findings provide defenders and AI governance teams with a concrete, reproducible case study of how gradual escalation and social-manipulation jailbreaks bypass content safeguards in production-available models, closing a documentation gap around legacy model risk in multi-cloud deployments. Residual gaps remain around model deprecation policy, version-pinned API consumer risk, and the absence of runtime content enforcement independent of the model itself.

OpenAI and AWS Launch Daybreak Red and Blue on Amazon Bedrock

FIRST LOOK ATLAS OWASP LOW ▲ 7.2 AWS Machine Learning Blog Aug 12, 2026

OpenAI's Daybreak Red and Daybreak Blue security-focused AI models are now available to eligible customers on Amazon Bedrock, bringing specialised offensive simulation and defensive analysis capabilities into AWS's managed AI platform. This closes a meaningful gap for defenders by providing purpose-built AI tooling for red-team automation and security operations within an enterprise-grade, governed cloud environment. Realising the full benefit will depend on organisational maturity in integrating AI-assisted security workflows and clarity around eligibility and access controls.

AWS Adds Bedrock Guardrails Best Practices for Code Generation

FIRST LOOK ATLAS OWASP MEDIUM ▲ 6.2 AWS Machine Learning Blog Jul 24, 2026

AWS has published guidance on applying Amazon Bedrock Guardrails to code generation workflows, detailing how to configure content filters, topic denials, and output controls for AI-assisted coding pipelines. For defenders, this surfaces the inverse risk: organisations that misconfigure or partially implement these guardrails expose code generation endpoints to prompt injection, malicious code output, and filter-evasion attacks. Security teams must treat guardrail configuration as a first-class security control, not a default-on safety net.

AWS Brings NVIDIA Nemotron and OpenAI GPT to GovCloud

FIRST LOOK ATLAS OWASP HIGH ▲ 6.8 AWS Machine Learning Blog Jul 02, 2026

AWS has expanded Amazon Bedrock in GovCloud (US) to include NVIDIA Nemotron and OpenAI's open-weight GPT OSS models, enabling U.S. government agencies and defense contractors to run frontier LLMs within FedRAMP High and DoD SRG compliance boundaries. This expansion introduces large, capable open-weight models into sensitive government mission workflows — including intelligence analysis, security log review, and contract automation — dramatically increasing the consequence of a successful prompt injection or jailbreak. Defenders must account for the elevated impact of model compromise in classified-adjacent environments, supply chain trust assumptions around open-weight model weights, and the risk of agentic workflows operating with privileged data access under reduced human oversight.

AWS Launches Bedrock AgentCore for Autonomous Payments

FIRST LOOK ATLAS OWASP HIGH ▲ 7.8 AWS Machine Learning Blog Jun 23, 2026

AWS has launched Amazon Bedrock AgentCore Payments, a managed infrastructure layer that enables AI agents to autonomously transact with external model providers and services using the x402 payment protocol, without human intervention. This capability introduces a new class of financial attack surface where compromised or manipulated agents can autonomously spend real funds, exfiltrate value, or be redirected to malicious service endpoints. Defenders must now treat agent payment credentials and spending budgets as first-class financial controls, on par with cloud IAM policies.

AWS Launches Amazon Bedrock AgentCore Harness

FIRST LOOK ATLAS OWASP HIGH ▲ 8.2 AWS Machine Learning Blog Jun 19, 2026

AWS has made Amazon Bedrock AgentCore Harness generally available, providing a managed abstraction layer that reduces agent deployment to two API calls while bundling sandboxed compute, persistent memory, tool gateway, browser access, identity management, and observability. For defenders, this dramatically lowers the barrier to deploying autonomous agents with filesystem access, shell execution, web browsing, and multi-provider model switching — compressing what was a weeks-long infrastructure project into minutes. Security teams face an expanded attack surface where prompt injection, tool abuse, cross-session memory poisoning, and supply chain risks through AWS-curated skill catalogs now arrive as a single, tightly integrated managed service rather than individually reviewable components.

Amazon Bedrock AgentCore Ships with RAG and Memory

FIRST LOOK ATLAS OWASP HIGH ▲ 7.2 AWS Machine Learning Blog Jun 16, 2026

Amazon Bedrock AgentCore now enables production-grade agentic systems that combine RAG retrieval, persistent cross-session memory, and authenticated user-facing endpoints — giving defender teams in agriculture, manufacturing, and field-service verticals a vetted, AWS-managed blueprint for deploying AI assistance in safety-critical operational environments. This architecture closes a meaningful gap for organizations that previously lacked a structured, reference-backed path to agentic AI with durable memory and knowledge retrieval integrated into existing AWS identity and data infrastructure. Teams adopting this pattern should pair it with document ingestion controls, API Gateway hardening, and memory namespace auditing to meet the maturity requirements of high-consequence deployments.

Amazon Bedrock Prompt Injection Traverses Agent Hierarchies

ATLAS OWASP HIGH ▲ 8.5 Palo Alto Unit 42 Apr 23, 2026

Unit 42 researchers conducted red-team analysis of Amazon Bedrock's multi-agent collaboration framework, demonstrating how attackers can systematically exploit prompt injection to traverse agent hierarchies, extract system instructions, and invoke tools with attacker-controlled inputs. The research reveals that multi-agent architectures introduce compounded attack surfaces through inter-agent communication channels, though no underlying Bedrock vulnerabilities were identified. Properly configured Guardrails and pre-processing stages effectively mitigate the demonstrated attack chains.

Amazon-Bedrock

Stay ahead of the threat.