AWS Security Agent exploits 33 of 37 new real-world CVEs in autonomous test
AWS reports its autonomous penetration-testing agent solved 89 percent of recent vulnerabilities without prior exploit knowledge or public proof-of-concepts.
Key points
- AWS Security Agent captured flags for 33 of 37 recently disclosed CVEs in containerized targets.
- The agent operated from unauthenticated positions without access to proof-of-concept code or exploit hints.
- Two results were reclassified as off-path, and two missed due to destructive actions that prevented flag retrieval.
AWS published results showing its autonomous penetration-testing agent, AWS Security Agent, successfully exploited 33 of 37 recently disclosed Common Vulnerabilities and Exposures. The agent, now part of AWS Continuum, operated against live, containerized targets containing hidden flags at each vulnerability’s intended sink. The test measured the agent’s ability to discover and exploit bugs without prior knowledge of the specific attacks.
The agent started from unauthenticated or low-privilege positions using only an endpoint URL and a one-line hint. It had to discover the vulnerability, build a working exploit, chain primitives where necessary, and extract the flag. An integrity audit confirmed that 33 captures were achieved through the intended vulnerability path, representing an 89.2 percent success rate.
Methodology and contamination controls
AWS designed this benchmark to address weaknesses in public CVE-based agent tests, which often suffer from data contamination. Public suites like CVEBench and XBOW are effectively saturated because current models recognize vulnerabilities after their write-ups enter training data. This makes it difficult to distinguish between genuine exploitation capability and memorized answers.
To reduce contamination, AWS sourced challenges from freshly disclosed CVEs, making it unlikely that end-to-end solutions existed in model training data. The agent was also disabled from performing runtime CVE lookups, preventing it from fetching public proof-of-concepts mid-exploit. AWS describes the results as contamination-reduced rather than contamination-free, noting that recent advisories and partial discussions can still leak into training data.
Target scope and failure analysis
The targets represented software types common in production environments, including web frameworks, container registries, machine learning and AI platforms, ecommerce stacks, tRPC APIs, media platforms, and an LDAP admin console. These targets spanned eight vulnerability classes, ranging from SQL injection to server-side request forgery and multi-step cross-site scripting chains.
Two captures were reclassified as off the intended path, leading AWS to harden those challenges and count them as unsolved. In two other cases, the agent found and exploited the bug but took the target down before the flag could be read. AWS noted that non-destructive guardrails in production engagements prevent such actions on customer systems.
What should you do?
Security professionals should monitor for updates regarding AWS Continuum and the integration of autonomous agents into security workflows. Organizations using web frameworks, container registries, or AI platforms should review their exposure to the vulnerability classes mentioned, such as SQL injection and SSRF. Teams should ensure their penetration testing strategies account for autonomous agents that can chain primitives without human intervention.
What to do and how to stay safe: AWS Security Agent
- Review inventory for web frameworks, container registries, and AI platforms mentioned in the scope to assess exposure to recent CVEs.
- Monitor vendor advisories for patches related to the eight vulnerability classes tested, including SQL injection and server-side request forgery.
- Evaluate current penetration testing protocols to determine if they simulate autonomous agent behavior that chains primitives from low-privilege positions.
- Verify that security tools enforce non-destructive guardrails during automated testing to prevent accidental service disruption.
Step-by-step guide: Cloud Misconfiguration Response: Containment, Recovery and Prevention Steps
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many CVEs did the AWS Security Agent successfully exploit?
The agent successfully exploited 33 of 37 recently disclosed CVEs, achieving an 89.2 percent success rate through intended vulnerability paths.
Did the agent use existing proof-of-concept code during the tests?
No, the agent started from unauthenticated positions with only an endpoint URL and a one-line hint, without access to exploits or proof-of-concepts.
Why did the agent miss two of the challenges?
In both missed cases, the agent exploited the bug but took the target down before the flag could be read, a behavior prevented by production guardrails.
