AWS Outlines Steering-File Method for AI Vulnerability Triage
Summary
AWS explains how steering files can structure AI vulnerability triage through code verification, evidence-based scoring, infrastructure controls and threat-intelligence signals. In its test, the method found 9 of 10 known vulnerabilities; it cannot verify live feeds or
Key points
- AWS recommends verifying referenced files and functions, dataflow, and call paths before reporting a vulnerability.
- The proposed confidence formula uses binary signals including confirmed taint flow, sanitization, public entry points, call-graph paths, and sink type.
- The method applies control-specific multipliers to account for infrastructure protections, with a scoring floor so controls do not reduce risk to zero.
- CISA KEV, EPSS, ransomware association, and public proof-of-concept availability can raise priority; the article says the model cannot query live threat-intelligence feeds.
- AWS tested the steering file on an application with 10 known vulnerabilities; it found nine, downgraded two infrastructure-mitigated findings, and verified claimed dataflows.
- The steering file does not provide programmatic taint tracking, live infrastructure verification, or execution-based exploitability testing.
Article Details
- Defense Focus
- Improve AI-powered vulnerability triage through structural verification, evidence-based confidence scoring, and infrastructure-aware prioritization.
- Detection Methods
- Before reporting a finding, verify that referenced files and functions exist, confirm the dataflow, and check for a call path.
- Use taint-flow confirmation, sanitization checks, public-entry-point status, call-graph evidence, and sink-category matching as binary confidence signals.
- Parse infrastructure-as-code and apply control-specific risk adjustments; distinguish access controls from attack-blocking controls.
- Use CISA KEV, EPSS, and public proof-of-concept availability as threat-priority signals.
- Validate the methodology against labeled true- and false-positive findings and known-vulnerable applications.
- Data Sources
- Repository source code, including file and function structure
- Dataflow and taint-analysis results
- Call-graph evidence
- Infrastructure-as-code files
- CISA Known Exploited Vulnerabilities (KEV) catalog
- Exploit Prediction Scoring System (EPSS) data
- Labeled vulnerability datasets and known-vulnerable applications
- Rule Types
- Persistent AI-assistant steering instructions in Markdown files
- On-demand Kiro skill configuration using a SKILL.md file with YAML front matter
- Platforms
- Kiro
- Claude Code
- Cursor
- GitHub Copilot
- AWS WAF
- AWS Lambda
- Amazon Virtual Private Cloud (Amazon VPC)
- AWS Identity and Access Management (IAM)
- Defensive Actions
- Reject findings that fail structural verification, regardless of how convincing the model's narrative or confidence sounds.
- Compute confidence from observable binary signals and calibrate the formula against labeled data.
- Apply vulnerability-specific control mappings and multiplicative attack-blocking adjustments with a risk floor; do not treat authentication as eliminating exploit impact.
- Cap threat-intelligence score boosts and use a live API integration when current KEV or EPSS status is required.
- Do not file P3 findings as security issues under the described methodology.
- For stronger validation, add deterministic AST-based taint tracking, live infrastructure verification, and sandboxed execution-based testing.
Vendors
Products
Amazon API GatewayIt can’t make API calls to verify that an AWS WAF rule is attached to the Amazon API Gateway in your deployed environment, or that a security group hasn’t been modified since deployment.Amazon Virtual Private Cloud (Amazon VPC)The application includes an AWS WAF with SQL injection rules in blocking mode, Amazon Virtual Private Cloud (Amazon VPC)-isolated AWS Lambda functions, and IAM authentication on each endpoint.AWS Identity and Access Management (IAM)A command injection behind AWS Identity and Access Management (IAM) authentication is still a command injection; the attacker pool is smaller, but the impact when exploited is unchanged.AWS LambdaThe application includes an AWS WAF with SQL injection rules in blocking mode, Amazon Virtual Private Cloud (Amazon VPC)-isolated AWS Lambda functions, and IAM authentication on each endpoint.AWS WAFThe model would report a SQL injection in a function that didn’t exist, claim HIGH confidence based on nothing structural, or ignore an AWS WAF in blocking mode directly in the request path.Claude CodeDifferent tools use different conventions—Kiro reads markdown files from a .kiro/steering/ directory, Claude Code uses CLAUDE.md, Cursor uses .cursorrules, and GitHub Copilot uses .github/copilot-instructions.md—but theCursorconventions—Kiro reads markdown files from a .kiro/steering/ directory, Claude Code uses CLAUDE.md, Cursor uses .cursorrules, and GitHub Copilot uses .github/copilot-instructions.md—but the function is the same:GitHub Copilotfiles from a .kiro/steering/ directory, Claude Code uses CLAUDE.md, Cursor uses .cursorrules, and GitHub Copilot uses .github/copilot-instructions.md—but the function is the same: persistent instructions that shapeKiroDifferent tools use different conventions—Kiro reads markdown files from a .kiro/steering/ directory, Claude Code uses CLAUDE.md, Cursor uses .cursorrules, and GitHub Copilot uses .github/copilot-instructions.md—but the