{"resourceId":"neuraltrust-agentcore-security-gaps-you-still-own-20261106","versions":[{"version":"external-dde4b26de0b38b4b7856127040bdc8b38b069a9a3be83e495bb299ee7f755e8b","resource":{"id":"neuraltrust-agentcore-security-gaps-you-still-own-20261106","title":"NeuralTrust: Amazon Bedrock AgentCore security gaps customers still own—session mapping, default execution roles, SDK versions and prompt-level threats","organization":"NeuralTrust","sector":"AI security vendor analysis","geography":"Global (AWS commercial Regions; GovCloud not specifically addressed)","publishedAt":"2026-11-06","publicationDate":"2026-11-06","eventDate":"2026-11-06","sourceName":"NeuralTrust blog","sourceLabel":"AgentCore Security: Gaps You Still Own","sourceUrl":"https://neuraltrust.ai/blog/agentcore-security","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["data-security","developers-agents","governance-procurement"],"finding":"NeuralTrust, which sells a competing agent gateway, re-read AgentCore Developer Guide pages, two AWS security bulletins and two BeyondTrust write-ups on November 6, 2026 without deploying AgentCore. It credits AgentCore with per-session microVM isolation, managed credentials and deterministic Gateway policy, but lists customer-owned gaps: AWS states AgentCore does not enforce session-to-user mappings; sessions run up to 8 hours on microVMs; code in the microVM can read execution-role credentials via the metadata service (MMDSv2 required from June 30, 2026); the CLI's default execution role permits invoking all foundation models in the account; InvokeAgentRuntimeForUser's user-id header is not verified against an IdP; policy only covers Gateway-routed traffic; guardrail scores are non-deterministic. It recaps the Code Interpreter Sandbox DNS issue (remediated April 15 per BeyondTrust) and SDK CVEs fixed in 1.6.1 and 1.18.1, and notes CloudTrail InvokeCodeInterpreter records carry no request parameters.","sledRelevance":"Directly relevant to SLED teams building agents on AgentCore (including newly GovCloud-available registry/runtime components): it enumerates controls that remain the agency's responsibility under shared responsibility.","evidence":"Third-party security vendor's documentation review, citing AWS docs and bulletins by title; explicit commercial interest (TrustGate). Not hands-on testing.","architectureImplications":"Recommends fronting Runtime with Gateway, blocking direct invocation, server-side session IDs bound to authenticated users, VPC network mode for sensitive Code Interpreter work.","governanceImplications":"Policy content, guardrail thresholds and memory-write review remain customer responsibilities; data-governance teams should review AgentCore content-use terms.","securityPrivacyImplications":"Highlights default role over-permissioning, unverified user-id header, metadata credential exposure and logging gaps.","caveats":"Commercial conflict of interest; did not deploy AgentCore; GovCloud specifics not addressed; AWS docs cited without links so claims should be checked against current AWS documentation.","streamIds":["aws"],"roles":{"sales":"Use this as a credibility aid, not a competitive weapon. Public-sector AgentCore buyers should hear plainly that AWS isolates sessions, but the agency still owns user-session binding, execution-role scope, SDK versions and prompt-level defenses. Discovery should ask who reviews default roles and whether direct runtime invocation is blocked. Note the author sells a competing gateway. A bounded engagement is an AgentCore shared-responsibility review against current AWS documentation, producing a short remediation list.","engineering":"Strong checklist for AgentCore designs. Validate each claim against current AWS docs: replace the CLI default execution role with model- and resource-scoped roles; generate session IDs server-side and bind them to authenticated users; require JWT rather than trusting user-id headers; route all tool traffic through Gateway and block direct invocation; use VPC mode for sensitive Code Interpreter work; upgrade bedrock-agentcore to at least 1.18.1. Constraints: GovCloud parity is not addressed. Proof of value: tests showing cross-user session reuse is rejected and direct invocation is denied.","delivery":"Turn the list into a pre-production gate. Dependencies are IAM, IdP/JWT configuration, Gateway policies and observability logs. Ownership sits with the platform security team and agent product owners. Governance checkpoints: execution-role review, session-binding test, policy LOG_ONLY-to-enforce promotion, SDK version check. Acceptance criteria, as proposals: no agent uses the default all-models role; cross-identity session reuse alerts fire in testing; CloudTrail data events and observability logs enabled. Risks include vendor-biased framing and stale documentation interpretations."},"roleDetails":{"sales":{"customerProblem":"Agencies building AgentCore agents may assume AWS isolation covers identity binding and least privilege, which it does not.","stakeholders":["CISO / security architect","Agent platform team","Data governance office"],"discoveryQuestions":["Who reviewed the default execution role?","Is direct runtime invocation blocked?","How are session IDs bound to users?"],"valueHypothesis":"A shared-responsibility review can close common AgentCore misconfigurations before production; risk reduction not measured.","potentialEngagement":"AgentCore shared-responsibility review against current AWS documentation.","unsupportedClaims":["Superiority of the author's product","GovCloud-specific behavior","Measured exploitation in SLED"]},"engineering":{"fit":"High relevance for any AgentCore build; GovCloud parity to be confirmed.","architectureIntegration":"Gateway in front of Runtime; JWT auth; scoped execution roles; VPC-mode Code Interpreter; observability logs.","prerequisites":["Current AWS AgentCore docs","IdP with JWT","bedrock-agentcore >= 1.18.1"],"constraints":["Policy covers only Gateway traffic","Guardrail scores non-deterministic","Regional feature differences"],"security":"Address session binding, metadata credential exposure, default roles and logging gaps.","proofOfValue":["Cross-user session reuse rejected","Direct invocation denied","Default role absent"]},"delivery":{"work":"Pre-production AgentCore security gate.","dependencies":["IAM","IdP/JWT","Gateway policies","Observability"],"ownership":"Platform security team with agent product owners.","skillsAdoption":"Cedar policy authoring, IAM scoping, agent threat modeling.","governanceCheckpoints":["Execution-role review","Session-binding test","Policy enforce promotion","SDK version check"],"acceptanceCriteria":["Proposed: zero agents on default all-models role","Proposed: session-reuse alert fires in test","Proposed: data events and observability logs enabled"],"risks":["Vendor bias","Documentation drift","False sense of isolation"]}},"retrievedAt":"2026-11-08T04:04:55Z","enrichedAt":"2026-11-08T04:11:17Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"None reported.","procurementImplications":"Promotes its own product; buyers should treat product recommendations separately from the documentation findings.","operatingModelImplications":"Agent security is an ongoing operating responsibility (SDK upgrades, policy testing, log review).","sourceVerification":{"openedUrl":"https://neuraltrust.ai/blog/agentcore-security","referenceExcerpt":"Under the shared responsibility model you still own session-to-user mapping, IAM roles, policy content, SDK versions and prompt-level threats.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}