What security vulnerabilities have been found in AI platforms like Amazon Bedrock, LangSmith, and SGLang?

Critical vulnerabilities have been discovered in Amazon Bedrock, LangSmith, and SGLang, potentially leading to data exfiltration and remote code execution. Specifically, Amazon Bedrock's Code Interpreter sandbox allows data exfiltration via DNS queries, LangSmith suffered a high-severity URL injection flaw enabling account takeover, and SGLang contains unpatched remote code execution vulnerabilities through unsafe pickle deserialization.

How can attackers exfiltrate data from Amazon Bedrock's Code Interpreter?

Attackers can exploit a flaw in Amazon Bedrock's Code Interpreter sandbox that permits outbound DNS queries, even when configured for "no network access." This allows them to bypass network isolation and establish command-and-control channels to exfiltrate sensitive information by encoding it within DNS requests. If the AI's IAM role has excessive permissions, attackers could gain an interactive reverse shell and execute commands stealthily.

What is AWS's response to the reported DNS exfiltration vulnerability in Bedrock?

Amazon has acknowledged the DNS exfiltration behavior in Bedrock but considers it "intended functionality" rather than a defect. They recommend that customers use VPC mode instead of sandbox mode for complete network isolation. AWS also advises implementing a DNS firewall to filter outbound DNS traffic as an additional security measure.

What is the LangSmith vulnerability, and what is its potential impact?

LangSmith has a high-severity URL injection vulnerability (CVE-2026-25750) that affects both self-hosted and cloud deployments. This flaw, rated 8.5 out of 10 in severity, can lead to account takeover, potentially allowing attackers to compromise user accounts and access sensitive data within the LangSmith platform.

What should organizations do to protect their AI systems from these vulnerabilities?

Organizations should reassess their configurations of AI platforms like Amazon Bedrock, LangSmith, and SGLang and implement stronger protective measures. For Bedrock, using VPC mode and DNS firewalls is crucial. Input validation and network isolation should be prioritized across all AI agent deployments to prevent data exfiltration and remote code execution.

AI Security Alert: Bedrock, LangSmith, SGLang Hacked

Recent security research has revealed critical vulnerabilities across leading artificial intelligence platforms, including Amazon Bedrock, LangSmith, and SGLang. These flaws expose sensitive data exfiltration pathways and enable remote code execution, challenging the core security assumptions of AI development environments. Organizations relying on these services now face an urgent mandate to reassess their configurations and implement stronger protective measures against sophisticated cyber threats.

Bedrock's DNS Flaw Undermines Network Isolation

Security researchers at BeyondTrust have detailed a novel method for exfiltrating sensitive data from AI code execution environments using domain name system (DNS) queries. The report highlights a significant flaw in Amazon Bedrock AgentCore Code Interpreter's sandbox mode, which allows outbound DNS queries despite being configured for "no network access." This oversight creates a pathway for attackers to bypass network isolation controls.

Attackers can exploit this behavior to establish bidirectional command-and-control channels and exfiltrate sensitive information. This becomes particularly dangerous if the AI's IAM role possesses overprivileged permissions to access AWS resources like S3 buckets. In such scenarios, an interactive reverse shell can be obtained, and commands executed stealthily via DNS queries. The flaw, which lacks a CVE identifier, carries a CVSS score of 7.5 out of 10.0.

While Amazon acknowledged the report, it determined the behavior to be "intended functionality rather than a defect." AWS now recommends customers use VPC mode instead of sandbox mode for complete network isolation. They also advise implementing a DNS firewall to filter outbound DNS traffic. Jason Soroko, a senior fellow at Sectigo, emphasized that "Operating within a VPC provides the necessary infrastructure for robust network isolation, allowing teams to implement strict security groups, network ACLs, and Route53 Resolver DNS Firewalls."

LangSmith and SGLang Face Critical Exploits

Beyond the Bedrock revelations, two other prominent AI tools, LangSmith and SGLang, are grappling with their own severe vulnerabilities. Miggo Security disclosed a high-severity security flaw in LangSmith (CVE-2026-25750), affecting both self-hosted and cloud deployments. This vulnerability, rated 8.5 on the CVSS scale, stems from a lack of validation on the `baseUrl` parameter, allowing for URL parameter injection.

A third flaw (CVE-2026-3989), rated 7.8, involves insecure deserialization in a crash dump replay utility. The CERT Coordination Center (CERT/CC) advises SGLang users to restrict access to service interfaces and implement network segmentation and access controls. This prevents unauthorized interaction with ZeroMQ endpoints and protects against potential compromises.