33 of 37 CVEs cracked by AWS agent using only URLs, no PoC code needed
An autonomous security tool successfully exploited 33 of 37 specific recently disclosed vulnerabilities in a controlled test, using only endpoint URLs and minimal hints.
Key points
- AWS Security Agent exploited 33 of 37 specific CVEs in an internal benchmark.
- The agent operated without access to public proof-of-concept code or exploit scripts.
- Two captures were reclassified as unsolved, and two attempts failed due to target crashes.
AWS Security Agent, now part of AWS Continuum, exploited 33 out of 37 specific recently disclosed Common Vulnerabilities and Exposures in a new internal benchmark. According to the AWS Security Blog, the autonomous penetration-testing agent achieved this result using only an endpoint URL and a single-line hint, without access to public exploit code or proof-of-concept materials.
The risk
The test involved live, containerized targets representing software commonly found in production environments. These included web frameworks, container registries, machine learning platforms, e-commerce stacks, and media platforms. The vulnerabilities spanned eight classes, including SQL injection, server-side request forgery, and complex cross-site scripting chains. Each target contained a hidden flag at the vulnerability’s intended sink, which the agent had to extract to count as a successful exploit.
Who is exposed
The agent started from unauthenticated or low-privilege positions in every scenario. It had to independently discover the vulnerability, construct a working exploit, and chain primitives where necessary. The targets were chosen to reflect real-world software stacks. Because the agent succeeded in 33 of the 37 specific cases without prior knowledge of the specific exploits, similar autonomous tools could potentially threaten any organization running these types of services with recent vulnerabilities.
Cost and compliance
The AWS Security Blog reported that two captures were reclassified during a per-sample integrity audit. Those attempts deviated from the intended exploitation path, leading the team to harden those challenges and count them as unsolved. Two other attempts missed the flag because the agent crashed the target before data could be read. Production guardrails prevent such destructive behavior on customer systems, but the benchmark recorded these as misses in the internal test environment.
What should you do?
Teams should verify that all software components are patched against recently disclosed CVEs immediately. Security managers should monitor for autonomous scanning activity that does not rely on known signatures. Organizations should assume that fresh vulnerabilities can be exploited within hours of disclosure, regardless of whether public exploit code exists.
The background in plain language
Autonomous agents use artificial intelligence to perform security tests without human guidance. Traditionally, attackers need proof-of-concept code or detailed write-ups to exploit a flaw. Modern AI models can analyze software behavior directly, constructing exploits from scratch. This capability means that the window between a vulnerability’s disclosure and its exploitation is shrinking. Teams usually rely on the time gap to apply patches. When agents can generate exploits autonomously, that buffer disappears, requiring faster detection and response cycles.
Background: Server-side request forgery (SSRF)
Server-side request forgery occurs when your application fetches a URL from an untrusted source without validating it. This lets attackers make your server request internal resources, private cloud data, or other machines, bypassing standard access controls and firewalls.
Read the full guide: Server-Side Request Forgery: How SSRF Bypasses Your Network Defenses
What to do and how to stay safe: AWS Security Agent
- Monitor network logs for unusual automated scanning patterns that lack traditional exploit signatures.
- Prioritize patching for recently disclosed vulnerabilities in web frameworks and API services.
- Implement strict input validation and least-privilege access controls to limit exploit success.
- Review container registry and machine learning platform configurations for known weak defaults.
Step-by-step guide: Prevent Cloud Misconfigurations: A Developer Checklist
General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the agent use public exploit code to succeed?
No, the agent operated without access to public proof-of-concept code or exploit scripts, relying only on endpoint URLs and hints.
What types of software were tested?
The targets included web frameworks, container registries, ML platforms, e-commerce stacks, media platforms, and LDAP admin consoles.
How many vulnerabilities were successfully exploited?
The agent exploited 33 of the 37 tested vulnerabilities, with two reclassified as unsolved and two missing due to crashes.
