AWS shows how to lock down AI agents

Published August 13, 2026

AWS published a security blueprint to stop AI agents from leaking data to employees who are not allowed to see it. The risk: an agent tricked by a manipulated prompt, or a bug in its code, could hand over records from other departments or customers.

Report priority
Medium
Targets
Amazon Bedrock AgentCore+4 more

How it works

Many AI agents are built with one shared set of broad credentials and rely on their own code to filter results by user, so a prompt injection attack or a bug in that filtering logic can expose the entire underlying dataset instead of just the requester's own records.

What to do

Check whether your organization's AI agents rely on the agent's own code to filter data by user instead of enforcing access at the database, Cognito, IAM, or Salesforce layer.

Follow AWS's AGENTSEC03 guidance: validate a signed identity token (with a department or role claim) before the agent runs, exchange it for user-scoped AWS credentials with AssumeRoleWithWebIdentity plus an IAM LeadingKeys condition for DynamoDB, tag documents with department metadata for Bedrock Knowledge Bases retrieval filters, and use AgentCore Identity's RFC 8693 token exchange so Salesforce's own sharing rules apply.

Technical details

Affected software: Amazon Bedrock AgentCore, AWS, Amazon DynamoDB, Amazon Cognito, Salesforce

AWS's reference architecture treats the agent as a pure orchestrator with no standing access rights of its own. A Cognito pre-token-generation Lambda injects a department claim and session-tag metadata into a JWT; Bedrock AgentCore Runtime validates that token before invoking any tool. Identity then propagates downstream three ways: AssumeRoleWithWebIdentity plus an IAM LeadingKeys condition scopes DynamoDB queries per user; ingestion-time metadata tags plus an application-layer filter scope Bedrock Knowledge Bases retrieval; and AgentCore Identity performs an RFC 8693 on-behalf-of token exchange so Salesforce enforces its own native sharing rules, with no user credential ever touching the agent's code.

References

View Original Source