AWS publishes agent vulnerability testing: off-target results were excluded after review
AWS published results from an autonomous penetration-testing agent in a containerised vulnerability test range. Integrity review confirmed that it completed the specified path in 33 of 37 tasks. The source also describes deviations from intended paths and cases where targets became unusable. These results do not represent performance across all production systems.
Source Facts
On 15 October, AWS described a new benchmark that packages recently disclosed vulnerabilities into controlled container targets to test whether agents can complete specified validation from a low-privilege starting point. AWS stresses that the benchmark is continually updated to reduce the effect of models memorising public tasks.
The official review reclassified two results achieved outside the intended vulnerability paths as unsolved; other tests were incomplete because targets failed. The article distinguishes lab targets from non-destructive controls in production testing. This site has not repeated the tests or verified the score.
When buying automated testing services, examine definitions of success, review methods, failure handling and limits on destructive actions together.
Original sources
AWS Security Agent (now part of AWS Continuum) exploited 33 of 37 new real-world CVEs
Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.
This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.
KEEP READING
Recommended reading
IllustrationLiteLLM explains package compromise: exposed keys must be revoked to complete the response
IllustrationSOCRadar examines SI agent-assisted extortion: human approval remains part of the intrusion process
Illustration