AWS repairs 2 bugs that can give attackers code from its AI agent
Check your bucket, because a new version does not give back a name that an attacker has.
On 10 September 2026, AWS gave notice of 2 bugs, CVE-2026-87912 and CVE-2026-87913, in AWS Security Agent, an AI tool that checks code. The plugin and the MCP server (a connection between an AI agent and tools) did not check who has the input bucket. An attacker could get the source archive of a workspace, with credentials in it.
How it works
The bucket name comes from a known account identifier. An attacker can make a bucket with that name first. AWS reports that this can let the attacker get the archive.
The fix
Plugin versions before 1.1.0 and server versions before 0.2.0 have the bug. Install the new versions. Then check that your account has the bucket for your region. You can also make it before first use.
What is not known
The notice gives no number of users with the bug. It gives no sign that attackers use the bug.
Insight: The tool that checks your code can give away your code
AWS reports that in a test this agent used 33 of 37 new vulnerabilities. This notice shows a bug in the plugin around the agent, not in the agent. A test result does not include the plugin, and a tool that holds credentials reads as a high value object. Find out where the data goes.
Sources
Posted
