Global S3: Another C2 Channel for AgentCore Code Interpreters

2026-06-01

Research indicates that AgentCore code interpreter sandbox S3 access can be exploited as a bidirectional command and control (C2) channel, enabling the creation of a reverse shell using S3 buckets and pre-signed URLs, even with DNS exfiltration fixes in place. Mitigations include implementing VPC mode and strict S3 gateway endpoint policies.