The report
AWS disclosed two distinct security issues in its deprecated Python Bedrock AgentCore Starter Toolkit on October 6, 2026. Both arise when one authenticated principal in an AWS account can alter a Bedrock Agent definition that someone else later imports. Toolkit versions 0.1.4 through 0.3.13 are affected; AWS lists 0.3.14 as patched and requires replacement of artifacts generated with vulnerable releases.
The first disclosure is a generated-Python injection. Maliciously crafted Bedrock Agent fields can be interpolated into Python source without sufficient encoding. The resulting program may execute under the importing user's local identity or an AgentCore Runtime role when run or deployed. This is not anonymous cross-account code execution: the actor needs permission to modify agent data, and a separate import-and-execution workflow must occur.
The second disclosure is OpenAPI external-reference resolution. A crafted action-group schema can cause the importer itself to read local files or make outbound network requests. Those operations take place during parsing, before the generated agent is run, and inherit the importing environment's accessible file and network privileges. A vulnerability in generating source code and a vulnerability in resolving specification references are different trust-boundary failures.
What a fixed library version does not fix
| Question | Generated-code issue | OpenAPI-reference issue |
|---|---|---|
| Lower-trust entry | Bedrock Agent data fields controlled by an authorized same-account editor | External reference values in an action-group OpenAPI schema |
| Vulnerable operation | Encoding fields into locally generated Python | Dereferencing file and network locations during agent import |
| Potential consequence | Code execution after generated program is run or deployed | Import-time file reads and outbound requests |
| Required correction | Fixed generator plus replacement of previously generated output | Fixed importer plus replacement of affected imports and output as advised |
A team that upgrades the Python dependency but continues to deploy old generated code has not completed the response. Both AWS advisories call for re-importing affected agents with version 0.3.14 or later and replacing earlier local and deployed artifacts. Their stated long-term replacement is the supported @aws/agentcore npm CLI, which AWS says is not affected by these particular issues.
The initial containment question is who could edit the source agent, and which users or deployment jobs imported it. AWS specifically recommends restricting bedrock:CreateAgentActionGroup, bedrock:UpdateAgentActionGroup and bedrock:AssociateAgentCollaborator to trusted principals. For local importers, file visibility and egress policy determine how far the OpenAPI reference issue can reach. The Python-generation advisory and reference-resolution advisory are first-party statements; neither documents a count of compromised customers or proves in-the-wild use.