The exporter/importer transfers an AI agent definition from a managed Bedrock environment into local Python code. The dangerous boundary is not the model deciding to run a tool: it is an ordinary code generator treating attacker-modifiable data-plane strings as Python source. A same-account principal with agent-editing rights could plant content that is…
Inspect the ClaimsCase · DiggingBeagle record
Bedrock AgentCore importer generated executable Python from untrusted agent fields
AWS disclosed that an authenticated actor able to modify a Bedrock Agent in the same account could plant fields that the Python importer embeds unsafely into executable source; toolkit 0.3.14 fixes generation, but old artifacts need replacement.
Scope
Reported finding as of 2026-10-13; publication and observation dates are distinguished in the linked source. No production exploitation is inferred without explicit evidence.
Assessment profile
Assessment method- Exploitation
- not established
- Evidence
- Grade B
- Remediation
- fixed reported
- AI role
- AGAINST AI
Basis and provenance
Evidence desk assessment of the pinned Claims and source provenance, checked against the public primary report or advisory. AWS first-party advisory confirms the affected importer versions, same-account authoring prerequisite, generated source execution boundary, patched 0.3.14 and required replacement of old outputs; real customer compromise is not established. Impact remains unbanded because verified real-world affected scope and realized harm are not established. Findings are not independent reproduction by DiggingBeagle.
Assessed Oct 14, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP5-AWS-AGENTCORE-GENERATED-PYTHON-1 · CLM-CP5-AWS-AGENTCORE-GENERATED-PYTHON-2 · CLM-CP5-AWS-AGENTCORE-GENERATED-PYTHON-3 · AWS GHSA-37r5-8xpw-vxp9: generated code injection from crafted Bedrock Agent data
At a glance
The attack can be planted during a legitimate agent administration workflow and execute later under a different principal when generated Python is run. Merely updating a toolkit dependency leaves vulnerable source previously generated on disk or in deployment images. Inventory the provenance and age of generated artifacts separately from the currently…
Read the implicationsNo independent count of exploitable deployments or confirmed hostile imports is established. Which older generated files remain in service requires an operator inventory.
Limits and uncertaintyFull account
The exporter/importer transfers an AI agent definition from a managed Bedrock environment into local Python code. The dangerous boundary is not the model deciding to run a tool: it is an ordinary code generator treating attacker-modifiable data-plane strings as Python source. A same-account principal with agent-editing rights could plant content that is later incorporated into generated code and executed by the importing developer or runtime.
AWS identifies 0.3.14 as the fixed toolkit release and separately warns that code generated with a vulnerable importer must be regenerated. The attacker needs same-account agent-modification permissions and a subsequent import/run path; this is not anonymous Internet RCE and not a proven customer compromise. The distinction between a fixed generator and unsafe output already produced is central to the remediation.
Claims & evidence
CLM-CP5-AWS-AGENTCORE-GENERATED-PYTHON-1Versions 0.1.4 through 0.3.13 of bedrock-agentcore-starter-toolkit are affected, with version 0.3.14 listed as patched.supported
Basis: reported finding
- supportsAWS GHSA-37r5-8xpw-vxp9: generated code injection from crafted Bedrock Agent dataprimary disclosure
Advisory: Affected versions and Patched versions
CLM-CP5-AWS-AGENTCORE-GENERATED-PYTHON-2An authenticated principal in the same AWS account who can modify an agent may cause imported generated Python to execute under the importer user or AgentCore runtime role after another user imports and runs it.supported
Basis: reported finding
- supportsAWS GHSA-37r5-8xpw-vxp9: generated code injection from crafted Bedrock Agent dataprimary disclosure
Advisory: Summary and Impact
CLM-CP5-AWS-AGENTCORE-GENERATED-PYTHON-3AWS instructs customers to re-import previously imported agents with a fixed toolkit and replace previously generated local/deployed artifacts; upgrading the dependency alone does not rewrite old output.supported
Basis: reported finding
- supportsAWS GHSA-37r5-8xpw-vxp9: generated code injection from crafted Bedrock Agent dataprimary disclosure
Advisory: Patches, re-import and artifact replacement
Implications
The attack can be planted during a legitimate agent administration workflow and execute later under a different principal when generated Python is run. Merely updating a toolkit dependency leaves vulnerable source previously generated on disk or in deployment images. Inventory the provenance and age of generated artifacts separately from the currently installed importer version.
Controls and mitigations
- Upgrade to 0.3.14 or migrate to the supported @aws/agentcore CLI; regenerate and replace code artifacts produced by affected Python toolkit releases.
- Restrict Bedrock Agent action-group, collaborator and prompt-editing permissions to trusted same-account principals, and do not run importer output from unreviewed agent definitions.
Unknowns and contradictions
- No independent count of exploitable deployments or confirmed hostile imports is established.
- Which older generated files remain in service requires an operator inventory.
Sources and citation
Material revision history
- Oct 13, 2026 · Published version · first publication · revision 144