Cracks in the Bedrock: Escaping the AWS AgentCore Sandbox

Researchers discovered that AWS Bedrock AgentCore’s “sandbox” mode could be bypassed via DNS tunneling, allowing attackers to exfiltrate sensitive credentials and establish covert command-and-control channels—defeating the intended isolation and exposing cloud environments to significant risk.