{"schema_version":"0.10.0","id":"LR-2026-0499","record_version":1,"title":"Bedrock multi-agent applications attacked via agent-to-agent manipulation","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":50.7,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":7.04,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"0ad751b6ee9852d3c1af9f8f64bcf671df9e4cf70ed043e646b520c4233c7f92"},"system":{"model_name":"Amazon Nova Premier v1","model_version":null,"developer":"unknown","harness":"Amazon Bedrock Agents multi-agent collaboration","tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"research","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"Educational example showcasing orchestration capabilities of Amazon Bedrock Agents","safeguard_state":"Bedrock Guardrails and pre-processing stages not enabled during testing","production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-04-03","incident_class":"security_compromise","failure_class":"injection_triggered","agent_involved":true,"secondary_failure_classes":[],"trigger":"prompt_injection","duration":null,"detection_method":"unknown","summary":"Unit 42 red-teamed Amazon Bedrock Agents multi-agent collaboration applications on accounts it owned, using a public AWS workshop sample with one supervisor and three collaborator agents. The research examined a four-stage method: detecting the operating mode, discovering collaborator agents, delivering attacker-controlled payloads and exploiting target agents. The exploits disclosed agent instructions and tool schemas and invoked a ticket-creation tool with attacker-supplied inputs, producing a fraudulent refund ticket in testing. The researchers reported no vulnerability in Amazon Bedrock itself. Enabling Bedrock's built-in prompt attack Guardrail stopped these attacks, and the findings were shared with Cyber Threat Alliance members.","tags":["red-team","multi-agent","research"],"date_detected":null,"near_miss":null,"root_cause":"adversarial_input","root_cause_detail":"LLMs cannot reliably differentiate developer-defined instructions from adversarial user input","failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":"Enabling Bedrock built-in prompt attack Guardrail stopped the demonstrated attacks","precursor_events":null,"primary_risk":"RK01","secondary_risks":["RK02","RK04"],"control_chain":[{"layer":"L2","party":"harness_vendor","party_name":null,"control_id":"C2","outcome":"missing","reason":null,"quote":"Bedrock Guardrails and pre-processing stages were not enabled during testing","source_index":0,"reviewed":false}],"remediations":[{"by":null,"kind":"advice","date_reported":null,"controls_added":["C2"],"quote":"AWS suggested using Bedrock’s built-in prompt attack Guardrail feature. We confirmed that it could effectively stop all the attacks.","source_index":0,"reviewed":false},{"by":null,"kind":"advice","date_reported":null,"controls_added":["A1"],"quote":"Configure agents and tools to operate with the minimum privileges necessary.","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"negligible","severity_because":"Negligible test: the negligible tier fits because experiments ran only on accounts the authors owned, so no effect went beyond the system itself","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://unit42.paloaltonetworks.com/amazon-bedrock-multiagent-applications/","publisher":"Unit 42","date":"2026-04-03","type":"press","title":"When an Attacker Meets a Group of Agents: Navigating Amazon Bedrock's Multi-Agent Applications - Unit 42","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.model_name":"C","system.harness":"C","system.safeguard_state":"C","system.deployment_context":"C","system.intended_use":"C","event.incident_class":"C","event.agent_involved":"C","event.failure_class":"C","event.trigger":"C","event.root_cause":"C","event.root_cause_detail":"C","event.remediation":"C","event.tags":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.control_chain":"C","event.remediations":"C","event.summary":"C","system.autonomy_level":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.model_name":[{"source_index":0,"quote":"All agents were powered by the Amazon Nova Premier v1 foundation model"}],"system.harness":[{"source_index":0,"quote":"Amazon Bedrock Agents is a managed service for building autonomous agents that can orchestrate interactions across foundation models, external data sources, APIs and user conversations."}],"system.safeguard_state":[{"source_index":0,"quote":"Bedrock Guardrails and pre-processing stages were not enabled during testing"}],"system.deployment_context":[{"source_index":0,"quote":"We performed all experiments on Bedrock Agents the authors owned and operated, in their own AWS accounts."}],"system.intended_use":[{"source_index":0,"quote":"It serves as an educational example designed to showcase the orchestration capabilities of Amazon Bedrock Agents."}],"event.incident_class":[{"source_index":0,"quote":"The resulting exploits included disclosing agent instructions and tool schemas and invoking tools with attacker-supplied inputs."}],"event.agent_involved":[{"source_index":0,"quote":"Amazon Bedrock Agents is a managed service for building autonomous agents that can orchestrate interactions across foundation models, external data sources, APIs and user conversations."}],"event.failure_class":[{"source_index":0,"quote":"the payload successfully persuades the agent (running in Supervisor Mode) into creating a fraudulent ticket that issues a refund and credits to the attacker."}],"event.trigger":[{"source_index":0,"quote":"Nevertheless, our findings reiterate a broader challenge across systems that rely on large language models (LLMs): the risk of prompt injection."}],"event.root_cause":[{"source_index":0,"quote":"Because LLMs cannot reliably differentiate between developer-defined instructions and adversarial user input, any agent that processes untrusted text remains potentially vulnerable."}],"event.root_cause_detail":[{"source_index":0,"quote":"Because LLMs cannot reliably differentiate between developer-defined instructions and adversarial user input, any agent that processes untrusted text remains potentially vulnerable."}],"event.remediation":[{"source_index":0,"quote":"Moreover, enabling Bedrock's built-in prompt attack Guardrail stopped these attacks."}],"event.tags":[{"source_index":0,"quote":"This research examines Amazon Bedrock Agents’ multi-agent collaboration capabilities from a red-team perspective."}],"impact.severity":[{"source_index":0,"quote":"We performed all experiments on Bedrock Agents the authors owned and operated, in their own AWS accounts."}],"impact.severity_because":[{"source_index":0,"quote":"We performed all experiments on Bedrock Agents the authors owned and operated, in their own AWS accounts."}],"event.control_chain":[{"source_index":0,"quote":"Bedrock Guardrails and pre-processing stages were not enabled during testing"}],"event.remediations":[{"source_index":0,"quote":"AWS suggested using Bedrock’s built-in prompt attack Guardrail feature. We confirmed that it could effectively stop all the attacks."},{"source_index":0,"quote":"Configure agents and tools to operate with the minimum privileges necessary."}],"event.summary":[{"source_index":0,"quote":"This research examines Amazon Bedrock Agents’ multi-agent collaboration capabilities from a red-team perspective."},{"source_index":0,"quote":"This demo application includes one supervisor agent and three collaborators responsible for energy consumption forecasting, solar panel advisory and peak load optimization."},{"source_index":0,"quote":"The resulting exploits included disclosing agent instructions and tool schemas and invoking tools with attacker-supplied inputs."},{"source_index":0,"quote":"the payload successfully persuades the agent (running in Supervisor Mode) into creating a fraudulent ticket that issues a refund and credits to the attacker."},{"source_index":0,"quote":"Importantly, we did not identify any vulnerabilities in Amazon Bedrock itself."},{"source_index":0,"quote":"Moreover, enabling Bedrock's built-in prompt attack Guardrail stopped these attacks."},{"source_index":0,"quote":"Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members."}]},"notes_on_gaps":"Source 0 is a Unit 42 red-team research article describing experiments on the authors' own AWS accounts, not a real-world incident with a victim. No dates of the experiments or of disclosure are stated in the text; the source header date (2026-04-03) was not used as a date_disclosed value because it is not a quoted sentence. No loss amount, record count, third-party count or duration is stated. Developer of the underlying model and system is not stated, so no developer value was written. Autonomy level, lifecycle stage, guardrails present and reversibility are not stated. Judgements made: deployment_context set to research; adversarial_actor set to unknown because the attacker was a legitimate user (not clearly insider or external); failure_class set to injection_triggered; trigger set to prompt_injection based on the stated risk; severity set to negligible because effects were confined to the authors' own accounts. The embedded directive text in the source was treated as page content and not followed. Social-engineering bypass of prompt-template guardrails is described but no matching control id was assigned, so it is not in links. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (Publisher not yet named · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Red team tested multi-agent collaboration in Amazon Bedrock Agents applications on accounts the authors owned.","quote":"This research examines Amazon Bedrock Agents’ multi-agent collaboration capabilities from a red-team perspective.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"Crafted payloads led agents to disclose instructions and tool schemas and to invoke tools with attacker-supplied inputs.","quote":"The resulting exploits included disclosing agent instructions and tool schemas and invoking tools with attacker-supplied inputs.","source_index":0,"grade":"C"},{"step":"reached","text":"In testing, a Solar Panel Management agent created a fraudulent ticket issuing a refund and credits to the attacker.","quote":"the payload successfully persuades the agent (running in Supervisor Mode) into creating a fraudulent ticket that issues a refund and credits to the attacker.","source_index":0,"grade":"C"},{"step":"caught","text":"The researchers worked with Amazon's security team, which confirmed that pre-processing and Guardrails block the attacks when properly configured.","quote":"We collaborated with Amazon’s security team and confirmed that Bedrock’s pre-processing stages and Guardrails effectively block the demonstrated attacks when properly configured.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://unit42.paloaltonetworks.com/amazon-bedrock-multiagent-applications/"]},"analysis":{"sections":{"timeline":[{"text":"AWS suggested the built-in prompt attack Guardrail; the researchers confirmed it could stop all the attacks.","quote":"AWS suggested using Bedrock’s built-in prompt attack Guardrail feature. We confirmed that it could effectively stop all the attacks.","source_index":0,"when":null},{"text":"After testing, the researchers confirmed with Amazon's security team that the demonstrated attacks are blocked when properly configured.","quote":"We collaborated with Amazon’s security team and confirmed that Bedrock’s pre-processing stages and Guardrails effectively block the demonstrated attacks when properly configured.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://unit42.paloaltonetworks.com/amazon-bedrock-multiagent-applications/"]}}