🔶 Global S3: Another C2 Channel for AgentCore Code Interpreters

AWS AgentCore Code Interpreters in Sandbox mode allow unrestricted global S3 access (including cross-account, public/presigned URLs), enabling a bidirectional C2 channel via S3 polling, demonstrated as a full reverse shell PoC. Mitigation: use VPC mode with S3 Gateway Endpoints and strict endpoint policies.

https://sonraisecurity.com/blog/global-s3-another-c2-channel-for-agentcore-code-interpreters

#aws