Cases › security breach › LR-2026-0499
Bedrock multi-agent applications attacked via agent-to-agent manipulation
Preliminary Why: Publisher not yet named · subject to change
Status: advice only, no fix reported
No source states: loss or records, could do, deployer, industry.
Severity negligible: test: the negligible tier fits because experiments ran only on accounts the authors owned, so no effect went beyond the system itself
Unit 42 red-teamed Amazon Bedrock Agents multi-agent collaboration applications on accounts it owned, using a public AWS workshop sample with one supervisor and three collaborator agents. The research examined a four-stage method: detecting the operating mode, discovering collaborator agents, delivering attacker-controlled payloads and exploiting target agents. The exploits disclosed agent instructions and tool schemas and invoked a ticket-creation tool with attacker-supplied inputs, producing a fraudulent refund ticket in testing. The researchers reported no vulnerability in Amazon Bedrock itself. Enabling Bedrock's built-in prompt attack Guardrail stopped these attacks, and the findings were shared with Cyber Threat Alliance members.
What happened
What was done
“AWS suggested using Bedrock’s built-in prompt attack Guardrail feature. We confirmed that it could effectively stop all the attacks.”
Risks
Primary50 incidents
Rising: 6 vs 2.8 a week
Also63 incidents
Rising: 5 vs 2.2 a week
Read from the sources; not yet reviewed by a person.
Controls
HarnessDid not exist Prompt-injection detection
Control failure chain
L1 · ModelAmazon Nova Premier v1Model provider
No source mentions a control at this layer.
Model version not linked to a model card.
L2 · HarnessAmazon Bedrock Agents multi-agent collaborationAgent framework vendor
Other controls for this risk at this layer, not mentioned in the sources: Outside content treated as data, not instructions, Confirmation after untrusted input, Validation of tool inputs and outputs, Tool allow-list.
L3 · ApplicationDeployer not namedDeployer
No source mentions a control at this layer.
Other controls for this risk at this layer, not mentioned in the sources: Human approval for high-impact actions, Least-privilege access for the agent, Segmentation of agent components, Alerts on unusual tool use.
L4 · Infrastructure / targetOrganisation hit
No source mentions a control at this layer.
EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target
Controls for this risk: result in this incident
| Control | Part of the system | Result |
|---|---|---|
| Prompt-injection detection | L2 Harness | Did not exist |
| Tool allow-list | L2 Harness | Not stated in sources |
| Confirmation after untrusted input | L2 Harness | Not stated in sources |
| Outside content treated as data, not instructions | L2 Harness | Not stated in sources |
| Validation of tool inputs and outputs | L2 Harness | Not stated in sources |
| Least-privilege access for the agent | L3 Application | Not stated in sources |
| Human approval for high-impact actions | L3 Application | Not stated in sources |
| Segmentation of agent components | L3 Application | Not stated in sources |
| Alerts on unusual tool use | L3 Application | Not stated in sources |
Similar incidents
Evidence
- Cause hostile input carried instructions
- What set it off hidden instructions in its input
- What was done Enabling Bedrock built-in prompt attack Guardrail stopped the demonstrated attacks
No source states: when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, what was done.
Show the full account: 2 items from the primary sources
What happened, in order
Not dated in the sources:
- AWS suggested the built-in prompt attack Guardrail; the researchers confirmed it could stop all the attacks.
- After testing, the researchers confirmed with Amazon's security team that the demonstrated attacks are blocked when properly configured.
Show every field, with its source and grade
The AI system
What happened
Impact
Notes on gaps
The embedded directive text in the source was treated as page content and not followed. Social-engineering bypass of prompt-template guardrails is described but no matching control id was assigned, so it is not in links.
LR-2026-0499 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON