AWS Bedrock AI Platform Exposed to Eight Critical Attack Vectors, Research Reveals Amazon’s AWS Bedrock a platform enabling developers to build AI-powered applications by integrating foundation models with enterprise data and systems has been identified as a high-value target for attackers. Security researchers at XM Cyber uncovered eight validated attack vectors that exploit Bedrock’s connectivity to critical infrastructure, including Salesforce, Lambda functions, SharePoint, and vector databases. The vulnerabilities stem from misconfigured permissions and weak access controls, allowing attackers to manipulate logs, compromise knowledge bases, hijack AI agents, inject malicious workflows, degrade security guardrails, and poison prompts. Each vector begins with minimal privileges but can escalate to full system compromise. ### Key Attack Vectors 1. Model Invocation Log Attacks – Attackers can redirect or delete logs stored in S3 buckets, harvesting sensitive data or erasing forensic evidence. 2. Knowledge Base Attacks (Data Source) – By accessing S3, Salesforce, or SharePoint credentials, attackers bypass AI models to extract raw data or move laterally into Active Directory. 3. Knowledge Base Attacks (Data Store) – Compromised credentials for vector databases (Pinecone, Redis) or AWS-native stores (Aurora, Redshift) grant full access to structured enterprise data. 4. Agent Attacks (Direct) – Modifying agent prompts or attaching malicious executors enables unauthorized actions, such as database tampering or user creation. 5. Agent Attacks (Indirect) – Injecting malicious code into Lambda functions allows data exfiltration or model response manipulation. 6. Flow Attacks – Altering workflows to reroute data to attacker-controlled endpoints or bypassing authorization checks via modified condition nodes. 7. Guardrail Attacks – Weakening or removing content filters increases susceptibility to prompt injection and toxic output generation. 8. Managed Prompt Attacks – Modifying centralized prompt templates enables mass-scale data exfiltration or harmful content generation without detection. ### Impact & Implications The research highlights that attackers target Bedrock’s integrations rather than the AI models themselves. A single over-privileged identity can redirect logs, hijack agents, or access on-premises systems. Security teams must map attack paths across cloud and hybrid environments while enforcing strict permission controls to mitigate risks. The findings underscore the need for comprehensive visibility into AI workloads and their associated permissions to prevent exploitation. Full technical details, including architectural diagrams, are available in XM Cyber’s research report.