From the AWS edition of November 7, 2026
NeuralTrust: Amazon Bedrock AgentCore security gaps customers still own—session mapping, default execution roles, SDK versions and prompt-level threats
NeuralTrust · AI security vendor analysis · Global (AWS commercial Regions; GovCloud not specifically addressed)
- Publisher
- NeuralTrust blog
- Original publication
- 2026-11-06
- Source retrieved
- 2026-11-08
- Event date
- 2026-11-06
What happened
NeuralTrust, which sells a competing agent gateway, re-read AgentCore Developer Guide pages, two AWS security bulletins and two BeyondTrust write-ups on November 6, 2026 without deploying AgentCore. It credits AgentCore with per-session microVM isolation, managed credentials and deterministic Gateway policy, but lists customer-owned gaps: AWS states AgentCore does not enforce session-to-user mappings; sessions run up to 8 hours on microVMs; code in the microVM can read execution-role credentials via the metadata service (MMDSv2 required from June 30, 2026); the CLI's default execution role permits invoking all foundation models in the account; InvokeAgentRuntimeForUser's user-id header is not verified against an IdP; policy only covers Gateway-routed traffic; guardrail scores are non-deterministic. It recaps the Code Interpreter Sandbox DNS issue (remediated April 15 per BeyondTrust) and SDK CVEs fixed in 1.6.1 and 1.18.1, and notes CloudTrail InvokeCodeInterpreter records carry no request parameters.
Why it matters
Directly relevant to SLED teams building agents on AgentCore (including newly GovCloud-available registry/runtime components): it enumerates controls that remain the agency's responsibility under shared responsibility.
Evidence and measured results
Third-party security vendor's documentation review, citing AWS docs and bulletins by title; explicit commercial interest (TrustGate). Not hands-on testing.
Limitations and uncertainty
Commercial conflict of interest; did not deploy AgentCore; GovCloud specifics not addressed; AWS docs cited without links so claims should be checked against current AWS documentation.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-08; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Agencies building AgentCore agents may assume AWS isolation covers identity binding and least privilege, which it does not.
- Stakeholders
- CISO / security architect
- Agent platform team
- Data governance office
- Discovery questions
- Who reviewed the default execution role?
- Is direct runtime invocation blocked?
- How are session IDs bound to users?
- Value hypothesis
- A shared-responsibility review can close common AgentCore misconfigurations before production; risk reduction not measured.
- Potential engagement
- AgentCore shared-responsibility review against current AWS documentation.
- Unsupported claims
- Superiority of the author's product
- GovCloud-specific behavior
- Measured exploitation in SLED
Pre-sales engineering
Role takeaway
- Fit
- High relevance for any AgentCore build; GovCloud parity to be confirmed.
- Architecture and integration
- Gateway in front of Runtime; JWT auth; scoped execution roles; VPC-mode Code Interpreter; observability logs.
- Prerequisites
- Current AWS AgentCore docs
- IdP with JWT
- bedrock-agentcore >= 1.18.1
- Constraints
- Policy covers only Gateway traffic
- Guardrail scores non-deterministic
- Regional feature differences
- Security
- Address session binding, metadata credential exposure, default roles and logging gaps.
- Proof of value
- Cross-user session reuse rejected
- Direct invocation denied
- Default role absent
Delivery
Role takeaway
- Work
- Pre-production AgentCore security gate.
- Dependencies
- IAM
- IdP/JWT
- Gateway policies
- Observability
- Ownership
- Platform security team with agent product owners.
- Skills and adoption
- Cedar policy authoring, IAM scoping, agent threat modeling.
- Governance checkpoints
- Execution-role review
- Session-binding test
- Policy enforce promotion
- SDK version check
- Acceptance criteria
- Proposed: zero agents on default all-models role
- Proposed: session-reuse alert fires in test
- Proposed: data events and observability logs enabled
- Risks
- Vendor bias
- Documentation drift
- False sense of isolation
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Recommends fronting Runtime with Gateway, blocking direct invocation, server-side session IDs bound to authenticated users, VPC network mode for sensitive Code Interpreter work.
Governance
Who approves, reviews and stays accountable for outcomes?
Policy content, guardrail thresholds and memory-write review remain customer responsibilities; data-governance teams should review AgentCore content-use terms.
Security and privacy
What data, permissions and controls need testing?
Highlights default role over-permissioning, unverified user-id header, metadata credential exposure and logging gaps.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
None reported.
Procurement
What should contracts, pricing and exit terms secure?
Promotes its own product; buyers should treat product recommendations separately from the documentation findings.
Operating model
Which teams own the service once it runs?
Agent security is an ongoing operating responsibility (SDK upgrades, policy testing, log review).
Publication history
- 2026-11-07AWS · Issue 107 resources
Stable resource ID: neuraltrust-agentcore-security-gaps-you-still-own-20261106