AWS Security - AI
Oct 15, 2026
News
AWS Security Agent exploited 33 of the 37 recent CVEs in an internal AWS benchmark end to end.
The end-to-end success rate is 89.2%, confirmed by an integrity audit of each capture.
The agent started from a URL and a one-line hint, with no exploit or PoC, with a limit of 10 hours per target.
In the two failures, the agent found and exploited the flaw, then brought down the target before reading the flag.
The validator labeled 159 false positives from the agent and rejected 1,202 duplicates.
Read the original article
AWS Security Agent (now part of AWS Continuum) exploited 33 of 37 new real-world CVEs
aws.amazon.com
Cloud Security Alliance
Oct 15, 2026
News
Badal Bhushan proposes a two-gate authorization model for MCP tools exposed to agents.
The first gate decides whether a capability should be available to a given agent.
The second gate authorizes or not a specific use of the tool against a specific resource, based on identity and context.
Filtering tools/list reduces risk but is not an authorization, according to the author.
A system prompt is not an access control mechanism: a deterministic control outside the model must decide.
Read the original article
MCP Tool Exposure is a Privilege Grant: A Two-Gate Authorization Model for Agentic AI
cloudsecurityalliance.org
