TLDR Tech / InfoSec
When an Attacker Meets a Group of Agents: Navigating Amazon Bedrock's Multi-Agent Applications
Unit 42 red-teamed Amazon Bedrock's multi-agent collaboration feature and demonstrated a four-stage attack chain against unprotected deployments: operating mode fingerprinting via crafted payloads that probe for the agent_scenarios tag and AgentCommunication__sendMessage() tool, collaborator agent enumeration through social-engineered discovery prompts, mode-specific payload delivery to target sub-agents, and exploitation outcomes including system instruction extraction, tool schema disclosure, and fraudulent tool invocations with attacker-supplied inputs. No Bedrock vulnerabilities were identified. All attacks relied on prompt injection against applications running default templates without guardrails enabled. Enabling Bedrock's built-in pre-processing prompt and prompt-attack Guardrail blocks the demonstrated attack chain. Teams should enforce narrow-agent capability scoping, dual-layer tool-input validation, and least-privilege permissions across all agent-tool integrations.
Read the full story