AWS Details Architecture to Reduce Prompt Injection Risks in AI Agents
AWS has presented a detailed architecture aimed at preventing compromised or manipulated AI agents from accessing data beyond the original user permissions. The proposal centers on Amazon Bedrock AgentCore, which transfers authorization decisions away from the agent and into the infrastructure and connected services.
The primary risk emerges when an agent is granted broad credentials to query databases, repositories, and SaaS platforms. In the event of a prompt injection attack or application failure, the model could attempt to retrieve information the user was never authorized to view.
Under the demonstrated architecture, users authenticate through Amazon Cognito and receive JWT tokens containing contextual details such as department or role. The AgentCore Runtime validates these tokens before executing the agent, rejecting any requests that do not match the configured rules.
For database operations, particularly with DynamoDB, AWS issues temporary credentials linked to the individual user via AssumeRoleWithWebIdentity. IAM policies then restrict access exclusively to authorized data partitions, ensuring that a manipulated agent cannot bypass departmental separation controls.
The central principle is to maintain the agent strictly as an orchestrator rather than allowing it to decide access rights. Even if its behavior is altered by an attack, infrastructure-level controls continue to limit permitted operations.
Related articles
Cybercriminals Weaponize OpenClaw AI Agent in ClawHavoc Campaign to Distribute Infostealers
Threat actors have repurposed the OpenClaw AI agent to deliver infostealers by uploading hundreds of malicious skills to ClawHub. The campaign, named ClawHavoc, tricks users into executing encoded commands or installing required tools under the guise of helpful AI recommendations. Researchers at Trellix identified 341 malicious skills, with 335 targeting installation of Atomic macOS Stealer on macOS systems. On Windows, victims receive password-protected archives and fake verification utilities that mirror classic ClickFix tactics. Analysis of repository history uncovered 1,184 suspicious packages linked to 12 authors, enabling theft of passwords, browser data, crypto wallets, API keys, SSH keys, and source code. Users are advised to update OpenClaw, audit installed skills, remove suspicious packages, and rotate potentially compromised credentials while running the agent in a restricted environment.
Server Log Analysis Reveals How Major AI Crawlers Actually Behave on Websites
A detailed examination of server access logs shows that AI vendors operate multiple distinct bots with separate purposes rather than a single crawler. GPTBot performs scheduled training data collection while OAI-SearchBot builds search indexes and ChatGPT-User fetches pages in direct response to user queries. The same pattern appears with PerplexityBot and Perplexity-User at Perplexity as well as ClaudeBot and user agents at Anthropic. Blocking all AI-related user agents in robots.txt therefore prevents both training crawls and live user-driven visits. Analysis of 515 million AI bot events found only 408 requests for llms.txt, confirming the file sees negligible adoption. Verification of IP addresses against vendor-published ranges remains the reliable method for distinguishing genuine bots from spoofed traffic. Effective practices focus on clean HTML structure, fast response times, and selective robots.txt rules that allow user-agent traffic while restricting training crawlers.
Nearly 70% of Companies Lack Control Over AI Agent Privileges, PAM Survey Finds
A recent survey conducted by AM Media among viewers and participants of the webinar 'How to Choose the Best PAM in 2026' shows that 68% of organizations fail to fully control privileges assigned to AI agents and automated services. Another 67% report insufficient oversight of API keys, tokens, and secrets, while 63% cite gaps in managing CI/CD and DevOps tool access. Traditional human administrator accounts are better protected at 34%, highlighting a shift in risk toward machine identities. Experts from NGR Softlab and Solar Group emphasize that service accounts often interact with multiple systems and require broad rights, making their compromise far more damaging than individual user breaches. JumpServer PAM CEO Denis Morozov noted that AI integration into PAM platforms could help map complex permission matrices and quantify risks for security teams. Participants also prioritized usability (72%) and ease of deployment (63%) when selecting PAM solutions over cost considerations.
Aligning AI Adoption Maturity with AI Security Using CMMI and Russian Regulatory Requirements
Organizations frequently operate at mismatched maturity levels between AI implementation and AI security controls, creating significant gaps that lead to incidents and regulatory violations. The analysis maps both dimensions onto the five-level CMMI scale, showing how adoption often outpaces protection and highlighting the risks of Shadow AI, uncontrolled agents, and non-compliance. Key frameworks including OWASP AIMA, Google SAIF, NIST AI RMF, and MITRE ATLAS are aligned to CMMI levels L1 through L5. Russian requirements under FSTEC Order No. 117, effective March 2026, introduce mandatory controls for trusted AI technologies, data handling, and statistical response validation that activate precisely at the L2-to-L3 transition. The article details predictable organizational states from denial to managed agentic systems and provides a practical matrix linking each CMMI level to minimum security requirements and specific Russian compliance anchors such as GOST R 56939-2024 and ISO/IEC 42001.