Amazon Quick AI Flaw Exposed Backdoor in Frontend-Only Permission Controls Security researchers uncovered a critical vulnerability in Amazon QuickSight, Amazon’s AI-driven business intelligence platform, where custom permission settings designed to block AI chat agents for specific users were enforced only in the frontend leaving the backend API fully accessible. The flaw, a CWE-862 missing authorization bug, allowed any user with a basic account to bypass UI restrictions by sending direct HTTP requests to the Chat Agent API. Despite the frontend graying out chat options, a simple POST request to `https://quicksight.<region>.amazonaws.com/chat-agent` with a JSON payload could still retrieve AI-generated responses even for prompts like "Tell me about mangoes" regardless of intended restrictions. ### Key Details of the Vulnerability - Frontend-Only Enforcement: The UI suggested AI chat was disabled, but the API lacked server-side validation. - Default AI Agent Exposure: AWS automatically provisions a generic AI chat agent upon service activation, expanding the attack surface even when admins attempted to disable AI features. - No Cross-Account Leakage: The flaw was contained within the same AWS account, preventing access to other tenants. - Unauthorized Data Access: Users could extract insights from restricted datasets, violating confidentiality policies. - Shadow AI Usage: Covert interactions with AI agents undermined audit trails and governance controls. - Compliance Risks: Organizations under GDPR, HIPAA, or other regulations faced potential violations due to ineffective restrictions. ### AWS Response & Timeline - Disclosure: Fog Security reported the issue via HackerOne on March 4, 2026. - Fix Deployment: AWS implemented a regional patch by March 11 and completed a global rollout by March 12, after which unauthorized API calls returned a 401 Unauthorized response. - AWS Rating: Despite the fix, AWS classified the vulnerability as "none" and issued no public advisory, leaving many customers unaware their controls had been ineffective for over a week. The incident highlights a persistent challenge in AI-enabled cloud platforms: security controls must be enforced consistently across both UI and API layers. As AI agents become more embedded in SaaS offerings, reliance on frontend restrictions alone creates dangerous blind spots.