Weekly Security Roundup Covers AWS Bedrock Sandbox Escape and Wiz Acquisition
Summary
A weekly security roundup reports a demonstrated DNS-based escape from AWS Bedrock AgentCore, Google’s completed $32 billion Wiz acquisition, Interpol’s Operation Synergia results, and developments in AI security.
Key points
- Kinnaird McQuade demonstrated that DNS queries could create a bidirectional C2 channel from AWS Bedrock AgentCore’s Interpreter, enabling command execution and access to S3 contents; the article says credentials, PII, and financial data were exfiltrated.
- AWS reportedly reproduced the issue in September 2025, classified it as intended functionality, and updated its documentation describing sandbox mode.
- Google completed its $32 billion all-cash acquisition of Wiz after antitrust reviews in the United States and European Union.
- Interpol’s Operation Synergia ran from July 2025 through January 2026 across 72 countries; the newsletter reports 94 arrests, 212 devices seized, and more than 45,000 malicious IP addresses sinkholed.
- Microsoft Incident Response published a detection and response playbook covering direct prompt overrides, extractive abuse, and indirect prompt injection in enterprise AI tools.
- Surf AI launched with $57 million in seed and Series A funding; its platform uses a context graph and AI agents to prioritize risks and coordinate remediation with human oversight.
- Major technology companies granted $12.5 million to the Linux Foundation’s Alpha-Omega and OpenSSF initiatives to support open-source ecosystem security.
Article Details
- Event Type
- Reported cloud AI sandbox escape disclosure; Google completed its acquisition of Wiz.
- Impact
- Kinnaird McQuade demonstrated that DNS queries from the AWS Bedrock AgentCore Interpreter sandbox could establish a bidirectional C2 channel, run commands, access S3 bucket contents, and exfiltrate credentials, PII, and financial data. The article says AWS reproduced the issue in September 2025 and classified it as intended functionality, responding with updated sandbox documentation. Separately, Google completed its $32 billion acquisition of Wiz after antitrust review in the US and EU.
MITRE ATT&CK
People
Vendors
Amazon Web Servicesnews, notable breaches and disclosures, product launches, and industry funding rounds, including an AWS Bedrock AgentCore sandbox escape and Google’s acquisition of Wiz.Googleproduct launches, and industry funding rounds, including an AWS Bedrock AgentCore sandbox escape and Google’s acquisition of Wiz.Wizand industry funding rounds, including an AWS Bedrock AgentCore sandbox escape and Google’s acquisition of Wiz.
Products
Amazon Bedrock AgentCorenotable breaches and disclosures, product launches, and industry funding rounds, including an AWS Bedrock AgentCore sandbox escape and Google’s acquisition of Wiz.InterpreterHe and the team demonstrated a full sandbox escape from AWS Bedrock AgentCore’s Interpreter using nothing more exotic than DNS queries.