Can AWS Security Agent autonomously exploit 33 of 37 CVEs without PoC hints?

AWS Security Agent, now part of AWS Continuum, successfully exploited 33 out of 37 recently disclosed Common Vulnerabilities and Exposures in an internal test, according to the AWS Security Blog. The agent started from an unauthenticated or low-privilege position with only an endpoint URL and a one-line hint. It had to discover the vulnerability, build a working exploit, and extract a hidden flag without any provided proof-of-concept code.

Root cause

The test targeted software types commonly running in production services, including web frameworks, container registries, machine learning platforms, and ecommerce stacks. These targets spanned eight vulnerability classes, ranging from SQL injection to server-side request forgery and multi-step cross-site scripting chains. The goal was to measure the agent’s ability to exploit genuine bugs rather than rely on pre-existing knowledge of the vulnerabilities.

Attack path

The agent operated against live, containerized targets with flags hidden at the vulnerability’s intended sink. It could not pull public proof-of-concept code during the exploit process. This design aimed to close the retrieval path for contamination. The agent had to work from the target alone, discovering and chaining primitives where necessary to achieve full exploitation and flag extraction from a low-privilege starting point.

Affected versions

The benchmark included 37 specific, recently disclosed CVEs packaged as individual challenges. The source material does not list the specific CVE IDs or software versions tested. It notes that the challenges were sourced continuously from freshly disclosed vulnerabilities to ensure they reflected current threats landing in production environments. The focus was on recency to minimize the chance that the agent had memorized solutions from training data.

Mitigation

• Monitor for new CVE disclosures relevant to your specific software stack and deployment environments.
• Implement non-destructive guardrails in penetration testing to prevent accidental system downtime during exploitation attempts.
• Audit automated security tool outputs to distinguish between genuine exploitation and off-path or contaminated results.
• Ensure testing environments are isolated containers to safely validate vulnerability presence without impacting production systems.

What it means for organisations

Teams should evaluate how autonomous tools fit into their security operations and supplier risk assessments. Verify that vendors provide clear audit trails for automated findings to distinguish genuine threats from false positives. Discuss with engineering leads whether current testing methods adequately cover recent vulnerability classes like SSRF or complex XSS chains. Ensure that security agents operate within strict guardrails to prevent accidental disruption of live systems during assessment.

Background: Server-side request forgery (SSRF)

An attacker tricks your server into making requests to unintended destinations. The server acts as a proxy, sending data from internal services or cloud metadata endpoints back to the attacker. You stop this by validating URLs, restricting outbound connections, and stripping sensitive headers from forwarded requests.

Read the full guide: Server-Side Request Forgery: Step-by-Step Attack Mechanics

What to do and how to stay safe: AWS Security Agent

• Review recent CVE disclosures affecting your web frameworks, container registries, and AI platforms.
• Verify that your penetration testing tools use non-destructive methods to avoid taking down targets.
• Audit automated security results to ensure they represent genuine exploitation rather than memorized patterns.
• Once the vendor provides an update, apply patches to any identified vulnerable components in your environment.

Step-by-step guide: Identity and Access Management System: How It Controls Cloud Access

General security guidance from the CloudSec Press newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What percentage of CVEs did AWS Security Agent exploit in this test?

The agent successfully exploited 33 out of 37 CVEs, which is approximately 89.2 percent.

Did the agent have access to proof-of-concept code during the test?

No, the agent started with only an endpoint URL and a one-line hint, with no exploit or PoC provided.

How did AWS handle results that were not genuine exploits?

Two captures were reclassified as off the intended path and counted as unsolved after an integrity audit.