CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NInsufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated remote user to execute configured tools bypassing model invocation and security controls via crafted content blocks in conversation messages. AWS has addressed this issue. No customer action is required.
This week’s security news is dominated by AI-related threats, including a vulnerability exploited in Metabase, a new Shai-Hulud worm leveraging the MCP Registry, and a Chinese review of Palo Alto Networks. Alongside the…
Security flaws have been discovered in agent infrastructure used by AWS, Google, and Vercel, allowing attackers to bypass model checks and directly invoke tools without a legitimate model turn. These vulnerabilities stem…
