AWS Says Security Agent Exploited 33 of 37 Recent CVEs in Benchmark
Summary
AWS reports that its Security Agent exploited 33 of 37 recent CVEs end to end in an audited benchmark. Two other exploit attempts took targets offline before the agent could retrieve the seeded flags.
Key points
- AWS tested the agent against 37 CVEs disclosed in 2025–2026, using containerized targets and a low-privilege starting point.
- The benchmark withheld public proof-of-concepts and disabled runtime CVE lookup to reduce, but not eliminate, contamination.
- The agent captured 35 flags, but an integrity audit counted only 33 as exploitation of the intended vulnerabilities; two captures used unintended paths.
- In two other cases, the agent reportedly exploited the bugs but disrupted the targets before retrieving the flags.
- AWS reports a median capture time of about four hours, with a 10-hour limit per sample; the run used Claude Opus 5.
- The article describes multi-step exploit examples involving file upload, code execution, and SSRF, and reports that non-destructive exploitation and reliability guardrails are still being developed.
Article Details
- Publisher
- AWS
- Report Period
- Benchmark sample: 2025–2026 CVEs; run date not disclosed.
- Scope
- Evaluation of AWS Security Agent against recent CVEs in isolated, containerized targets.
- Sample Size
- 37 CVEs across one epoch; 10-hour limit per sample.
- Key Statistics
- After integrity audit, 33 of 37 challenges (89.2%) were genuine end-to-end captures.
- 35 of 37 flags were initially captured; 2 captures were reclassified after the audit.
- The agent had 2 genuine misses; in both, it exploited the bug but took the target down before reading the flag.
- The validator confirmed 234 high-confidence exploitable issues across the targets.
- The validator labeled 159 findings as false positives and rejected 1,202 additional findings as duplicates.
- Recommendations
- Harden exploitation to reduce destructive actions: throttle them, prefer read-only proof of exploit, and back off when a service appears unstable.
- Improve long-run resource handling and target-health recovery.
- Strengthen guardrails and scope enforcement to keep the agent within authorized scope and safe behavior.
- Keep per-CVE trajectory audits as a permanent gate for benchmark results.
Vendors
Products
AWS ContinuumWe applied AWS Security Agent (now part of AWS Continuum), our autonomous penetration-testing agent, to 37 real, recently disclosed Common Vulnerabilities and Exposures (CVEs), each packaged as a live, containerizedAWS Security AgentWe applied AWS Security Agent (now part of AWS Continuum), our autonomous penetration-testing agent, to 37 real, recently disclosed Common Vulnerabilities and Exposures (CVEs), each packaged as a live, containerizedClaude Opus 5The following table and figures show the results of a full run, including 37 CVEs and one epoch, run on Claude Opus 5 with a fixed 10-hour limit per sample.