In partnership with
AWS gave its autonomous pen-testing agent a URL and a one-line hint, then asked it to exploit a vulnerability it had never seen. It got there 33 times out of 37.
That comes from a post on the AWS Security Blog from October 15. The tool is AWS Security Agent, which AWS now lists as part of AWS Continuum.
Here's the setup. AWS picked 37 recently disclosed CVEs (Common Vulnerabilities and Exposures) from 2025 and 2026 and ran each one as a live containerized target, with a flag planted at the vulnerable spot. The agent started with zero exploit code. The run used Claude Opus 5 with a 10-hour limit per target, and CVE lookup was switched off at runtime to cut down on cheating. The authors call the result "contamination-reduced, not contamination-free," which I appreciate.
The agent captured 35 flags. After an audit, 33 came through the intended vulnerability from start to finish, which is 89.2 percent. The other 2 took a side route, so AWS hardened those challenges. Median time to capture was about 4 hours, and it chained together more than 6 multi-step attacks on its own.
Now the 2 misses. In both, the agent found the bug and exploited it, then took the target down before it could read the flag. One was a file upload to remote code execution challenge, and the agent left the app dead. The other kept attacking a service after getting root until the service fell over.
AWS says the benchmark had no non-destructive guardrails, unlike a real engagement. The team is working on throttling destructive operations, preferring read-only proof, and backing off when a service looks unstable. That work is still in progress.
Discover laptops with built-in intelligence.
Shift your workforce into hyper-productivity mode with Dell Pro laptops powered by Intel® Core™ Ultra with Intel vPro®. Shop on Dell Premier.
A few grains of salt. AWS graded its own homework. The validator also produced 159 auto-labeled false positives and 1,202 duplicate rejections, so a human still has to triage the output. And the post gives no pricing or availability.
The same day, AWS published Trust in Depth, which argues for limits that sit outside the agent, where its own reasoning can't switch them off. The pen-test result makes that case better than any slide. An agent that's good at breaking things will eventually break the wrong thing.
The post describes 4 layers: scope, know, bound and observe. The "bound" layer is the one to read. Policy in Amazon Bedrock AgentCore applies to every tool call that passes through AgentCore Gateway, and Strands Box sandboxes which files, services and credentials an agent can reach.
If you're studying for an AWS AI cert, learn where each control lives. Policy at the Gateway sits outside the model, and I'd bet exam writers like that distinction (that's my guess, not something AWS said).
And if you hire out pen tests or run a red team, ask your vendor one question. What does the agent do once it has root?
Keep Learning and Building.
Your workflows and documentation could open a new revenue stream. AI labs pay to license useful operational data. Bezel helps established companies find a data partner.