Securing AI Agent Behavior: Amazon Bedrock AgentCore and the Web4 Threat Landscape
The shift toward autonomous Web4 agents utilizing the Model Context Protocol (MCP) has created a critical security gap in identity and authorization. While Amazon Bedrock AgentCore implements granular IAM controls using aws:ViaAWSMCPService and aws:CalledViaAWSMCP to isolate agent-driven traffic, the agent skill marketplace presents a massive supply chain risk. Maliciously crafted agent "skills" have demonstrated the ability to bypass conventional security scanners, impacting approximately 26,000 agents, including corporate accounts. Mitigating these risks requires the adoption of emerging Web4 identity and payment standards (x402, EIP-8004) alongside advanced deceptive architectures like the AdvancedShelLM multi-agent honeypot to identify and influence autonomous adversarial behavior.
Agentjacking: CVE-2026-12957 Exploits Amazon Q via Malicious MCP Configurations
Wiz Research has identified a high-severity vulnerability (CVE-2026-12957, CVSS 8.5) in Amazon Q Developer that allows for remote code execution (RCE) via "Agentjacking." By leveraging the Model Context Protocol (MCP), attackers utilize a "Fake Bug Report" social engineering vector to lure developers into opening booby-trapped repositories. These repositories contain a malicious .amazonq/mcp.json configuration file, which the AI agent automatically parses and executes with the developer's full environment privileges. This creates a direct pipeline from a local IDE session to enterprise cloud infrastructure compromise, enabling the exfiltration of live AWS credentials, API keys, and SSH agent access, effectively bypassing traditional perimeter-based security controls.