Defend against AI agents that exploit 89% of fresh CVEs without prior training or proof-of-concept code

AWS Security Agent, now part of AWS Continuum, successfully exploited 33 of 37 recently disclosed Common Vulnerabilities and Exposures (CVEs) in a new internal benchmark. According to the AWS Security Blog, this test was designed to measure autonomous exploitation capabilities without relying on memorized solutions. The agent captured flags in 89.2 percent of the challenges, demonstrating end-to-end capability from discovery to extraction.

The risk

The test used 37 live, containerized targets, each containing a flag hidden at the vulnerability’s intended sink. The agent began from an unauthenticated or low-privilege position, provided only with an endpoint URL and a single-line hint. It had to discover the vulnerability, build a working exploit, chain primitives where necessary, and extract the flag without any exploit code or proof-of-concept (PoC) provided.

Two captures were reclassified as off-path after an integrity audit, meaning they did not follow the intended vulnerability route. These were counted as unsolved. Two additional attempts failed because the agent exploited the bug but crashed the target before the flag could be read. Production guardrails prevent such destructive behavior on customer systems, but these misses highlight the potential for denial-of-service side effects during automated exploitation.

Who is exposed

The targets represented software commonly found in production environments. According to the AWS Security Blog, the suite included web frameworks, a container registry, machine learning and AI platforms, an ecommerce stack, a tRPC API, several media platforms, and an LDAP admin console. These applications spanned eight vulnerability classes, including SQL injection, server-side request forgery (SSRF), and multi-step cross-site scripting (XSS) chains leading to admin cookies.

Cost and compliance

Public CVE benchmarks often suffer from data contamination, where models recognize vulnerabilities because their write-ups are in training data. This new benchmark sources challenges from freshly disclosed CVEs to minimize memorization. The agent was also disabled from looking up public CVE information during runtime, preventing it from fetching proof-of-concepts mid-exploit. This design separates the agent’s ability to exploit a bug from its prior knowledge of the solution.

Our take on the response

Organizations should recognize that autonomous agents can now exploit fresh vulnerabilities without prior exposure to specific proof-of-concepts. This suggests that relying solely on known exploit signatures may be insufficient. Security teams must prepare for attacks that chain primitives and navigate complex application logic autonomously.

What defenders should look for

Teams should monitor for unusual execution patterns that indicate automated exploitation rather than human-driven attacks. Look for rapid, sequential requests targeting different endpoints or parameters, which may signal an agent chaining primitives. Check for unexpected process spawns or network connections from application servers, especially after unauthenticated access.

Verify that application logs capture full request contexts to identify the specific input that triggered the vulnerability. Ensure that alerting rules cover lateral movement attempts and privilege escalation chains, not just initial entry points. Review container logs for anomalous behavior that deviates from standard application workflows.

Background: Cross-site scripting (XSS)

Cross-site scripting exploits the trust a browser places in a web page. An attacker injects malicious scripts into a vulnerable site. When another user visits that page, their browser executes the script. The attacker steals session tokens or redirects the victim. Proper input validation and output encoding stop this process.

Read the full guide: How Cross-Site Scripting Works Step by Step

What to do and how to stay safe: AWS Security Agent

• Verify that all publicly exposed endpoints enforce strict input validation and authentication to reduce the attack surface for autonomous agents.
• Monitor application logs for rapid, sequential requests that may indicate automated exploitation attempts or primitive chaining.
• Ensure that containerized applications run with minimal privileges to limit the impact of any successful exploitation.
• Review and update web application firewall rules to detect and block known exploitation patterns for SQL injection, SSRF, and XSS.

Step-by-step guide: Cloud Logging and Monitoring Best Practices for Detection

General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How did the agent exploit vulnerabilities without proof-of-concept code?

The agent discovered the vulnerability, built a working exploit, and chained primitives using only an endpoint URL and a one-line hint.

Why was a new benchmark necessary?

Public benchmarks can be contaminated by training data, so this test uses fresh CVEs and blocks runtime lookups to measure true exploitation capability.

What types of software were tested?

The targets included web frameworks, container registries, ML platforms, ecommerce stacks, and an LDAP admin console.