AWS Details Architecture to Reduce Prompt Injection Risks in AI Agents
AWS has presented a detailed architecture aimed at preventing compromised or manipulated AI agents from accessing data beyond the original user permissions. The proposal centers on Amazon Bedrock AgentCore, which transfers authorization decisions away from the agent and into the infrastructure and connected services.
The primary risk emerges when an agent is granted broad credentials to query databases, repositories, and SaaS platforms. In the event of a prompt injection attack or application failure, the model could attempt to retrieve information the user was never authorized to view.
Under the demonstrated architecture, users authenticate through Amazon Cognito and receive JWT tokens containing contextual details such as department or role. The AgentCore Runtime validates these tokens before executing the agent, rejecting any requests that do not match the configured rules.
For database operations, particularly with DynamoDB, AWS issues temporary credentials linked to the individual user via AssumeRoleWithWebIdentity. IAM policies then restrict access exclusively to authorized data partitions, ensuring that a manipulated agent cannot bypass departmental separation controls.
The central principle is to maintain the agent strictly as an orchestrator rather than allowing it to decide access rights. Even if its behavior is altered by an attack, infrastructure-level controls continue to limit permitted operations.
Related articles
US Accuses Chinese AI Companies of Industrial-Scale Model Distillation Targeting Claude, GPT, Gemini and Grok
US agencies have accused six Chinese artificial intelligence firms of conducting large-scale unauthorized distillation operations to replicate advanced capabilities from leading models including Claude, GPT, Gemini, and Grok. The activity is reported to have begun at least by late 2024 and involved DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI. Billions of tokens were extracted through millions of automated API requests routed via cloud providers, aggregators, and proxies to conceal origins and evade detection. The targeted capabilities included chain-of-thought reasoning, programming, software engineering, autonomous agent functions, and multimodal processing. Shared premium accounts and bulk subscriptions were used to lower costs while automated route-switching systems helped maintain access after blocks. Authorities assess that the sophistication and volume indicate distillation has become a core development method for these companies and likely occurred with Chinese government awareness. China has rejected the claims, stating its AI progress stems from independent innovation and calling the allegations unfounded.
Check Point Research Uncovers Cross-Session Command Channel in ChatGPT via JFrog Artifactory
Researchers at Check Point Research identified a covert channel that allowed commands to be passed between isolated ChatGPT sessions belonging to different user accounts. The channel exploited an internal JFrog Artifactory instance used by ChatGPT containers for package installation, enabling containers to read and write repository metadata that effectively served as a shared buffer. Attackers could inject malicious instructions into a victim's context through copied prompts, shared conversations, or custom GPTs, causing the assistant to execute hidden tasks while returning normal responses. In a demonstration, ChatGPT silently retrieved data from a connected Gmail account and forwarded it to the attacker's account. The technique potentially exposed chat history, uploaded files, and data from connected services including Google Drive, Microsoft Teams, and GitHub. OpenAI confirmed the affected Artifactory instance has been decommissioned, eliminating the channel, with no evidence of real-world exploitation reported.
Stop Asking If an AI Skill Is Safe — Ask What It Can Do Instead
A detailed analysis warns that AI agent skills distributed as simple text files can execute malicious commands with full user privileges. The article examines how prompt injection attacks embedded in skill.md files have already led to credential theft and persistent malware that survives system restores. Research by Snyk on 3984 public skills found that 36.8 percent contained at least one security issue and 13.4 percent had critical flaws. The author argues that traditional security badges are ineffective because skills can dynamically load payloads, target reviewers with injection, or change after initial review. Instead, a new tiered system called skill-xray classifies capabilities from inert text (T0) to runtime code loading (T4) and binds results to content hashes. The approach is implemented in an open-source MIT-licensed tool that combines static regex scanning with agent-based reporting to surface risks without issuing false safety guarantees.
Ideco NGFW Novum v23 Adds Shadow AI Discovery, Dynamic Routing and QoS Controls
Ideco has released NGFW Novum v23, introducing detection for 83 AI application protocols including ChatGPT, Claude, DeepSeek, GigaChat and YandexGPT. The update enables organizations to identify Shadow AI usage across networks without mandatory TLS decryption and adds new content-filter categories for AI agents and AI services. Enterprise routing capabilities have been expanded with Prefix lists, Route maps, OSPF zones, BGP aggregation and BFD profiles to support large distributed environments. Additional features include internal Virtual Ethernet and Virtual Switch interfaces for VCE connectivity, QoS traffic prioritization, MTU/MSS tuning for IPsec, certificate-based authentication in Ideco Client and detection of tunneled traffic inside SSH and TLS sessions. The release positions the NGFW as the first layer of an emerging AI Security Layer that combines discovery, policy enforcement and future LLM proxy controls.