S3 Access Enables Reverse Shells in AgentCore Code Interpreters
Research shows that AgentCore code interpreters, despite sandbox DNS restrictions, can still communicate bidirectionally via Amazon S3. By leveraging bucket access and presigned URLs, attackers can create a reverse shell, turning S3 into a covert C2 channel. The blog provides a proof‑of‑concept and mitigation guidance.