Importing an AI agent can look like passive configuration conversion, yet a schema resolver may dereference links as it parses. AWS disclosed that external OpenAPI references attached to a Bedrock agent action group could reach local files and outbound network destinations from the importer's own environment. A principal able to change the schema in the…
Inspect the ClaimsCase · DiggingBeagle record
AgentCore importer followed hostile OpenAPI references into files and networks
A separate AgentCore Starter Toolkit bug let crafted OpenAPI external references induce local file reads and outbound requests during agent import; toolkit 0.3.14 addressed it.
Scope
Reported finding as of 2026-10-13; publication and observation dates are distinguished in the linked source. No production exploitation is inferred without explicit evidence.
Assessment profile
Assessment method- Exploitation
- not established
- Evidence
- Grade B
- Remediation
- fixed reported
- AI role
- AGAINST AI
Basis and provenance
Evidence desk assessment of the pinned Claims and source provenance, checked against the public primary report or advisory. AWS distinguishes import-time external reference dereferencing from later generated Python execution, with the same affected toolkit range and patch/reimport requirement. No named victim or stolen data is reported. Impact remains unbanded because verified real-world affected scope and realized harm are not established. Findings are not independent reproduction by DiggingBeagle.
Assessed Oct 14, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP5-AWS-AGENTCORE-OPENAPI-REFS-1 · CLM-CP5-AWS-AGENTCORE-OPENAPI-REFS-2 · CLM-CP5-AWS-AGENTCORE-OPENAPI-REFS-3 · AWS GHSA-5xmr-2rcp-3j75: local reads and outbound requests during agent import
At a glance
A configuration parser can cause network and filesystem side effects before an operator runs the generated agent. An importer allowed to reach cloud metadata endpoints, sensitive local files or internal services may expose data despite a successful code-review step later in the workflow. The control belongs at reference resolution, not solely at Python…
Read the implicationsAny actual intercepted data or affected account is not established by the advisory. Deployment-specific file and network authorization varies with importer privileges.
Limits and uncertaintyFull account
Importing an AI agent can look like passive configuration conversion, yet a schema resolver may dereference links as it parses. AWS disclosed that external OpenAPI references attached to a Bedrock agent action group could reach local files and outbound network destinations from the importer's own environment. A principal able to change the schema in the same AWS account could choose references that exceed the intended trust boundary.
This is not the Python generation execution bug in a separate advisory: the file and network access occur during import-time reference resolution, before running generated code. The risk depends on the importing environment's network visibility and filesystem permissions, and the report does not establish actual theft from a named account. Both defects share a fixed toolkit version, but their root causes and detection requirements are different.
Claims & evidence
CLM-CP5-AWS-AGENTCORE-OPENAPI-REFS-1The vulnerable import path accepts crafted external OpenAPI reference values associated with a Bedrock Agent action group and can issue unexpected outbound HTTP requests or local file reads during the import operation.supported
Basis: reported finding
- supportsAWS GHSA-5xmr-2rcp-3j75: local reads and outbound requests during agent importprimary disclosure
Advisory: Summary and Impact
CLM-CP5-AWS-AGENTCORE-OPENAPI-REFS-2An authenticated same-account principal with permission to modify an action group OpenAPI schema could cause another user's importing environment to access arbitrary local files or network destinations.supported
Basis: reported finding
- supportsAWS GHSA-5xmr-2rcp-3j75: local reads and outbound requests during agent importprimary disclosure
Advisory: Impact, principal and import environment
CLM-CP5-AWS-AGENTCORE-OPENAPI-REFS-3The advisory lists affected toolkit releases 0.1.4 through 0.3.13 and repair in 0.3.14, with re-import and replacement of generated artifacts recommended.supported
Basis: reported finding
- supportsAWS GHSA-5xmr-2rcp-3j75: local reads and outbound requests during agent importprimary disclosure
Advisory: Affected versions; Patched versions; Patches
Implications
A configuration parser can cause network and filesystem side effects before an operator runs the generated agent. An importer allowed to reach cloud metadata endpoints, sensitive local files or internal services may expose data despite a successful code-review step later in the workflow. The control belongs at reference resolution, not solely at Python execution.
Controls and mitigations
- Upgrade the affected importer to 0.3.14 or move to the supported replacement CLI, and regenerate dependent output artifacts where advised by AWS.
- Limit the importer process to necessary files and egress destinations; reject untrusted OpenAPI external references and restrict agent action-group schema modification rights.
Unknowns and contradictions
- Any actual intercepted data or affected account is not established by the advisory.
- Deployment-specific file and network authorization varies with importer privileges.
Sources and citation
Material revision history
- Oct 13, 2026 · Published version · first publication · revision 144