Whose Fault When a Pentest Agent Attacks the Wrong Target

Presented at fwd:cloudsec London 2026

Transcript

1. Whose Fault When a Pentest Agent Attacks the Wrong Target Richard Fan
2. Who am I • Security Engineer • AWS Security Hero (Not Amazon employee) • Love finding AWS Service limit behind documentations
3. Once upon a time …
4. AWS Security Agent Continuum • Fully-managed AI Agent for security tasks in SDLC • Code Review • Design Review • Threat Modelling • Penetration Test
5. AWS Security Agent 1. Configure target website 4. Start pentest AWS Security Agent Target website https://target.com 3. Add Accessible Domains 3rd party website https://auth0.com 2. Verify domain name ownership
6. 1. Broken scope control
7. Broken scope control – DNS change after validation amazon.com A 10.0.1.1 (Private IP) _aws_securityagentchallenge.amazon.com TXT aws-securityagentdomain-verification=xxx Innocent target https://amazon.com (1.2.3.4) AWS Security Agent
8. Broken scope control – DNS change after validation amazon.com A 1.2.3.4 _aws_securityagentchallenge.amazon.com TXT aws-securityagentdomain-verification=xxx Innocent target https://amazon.com (1.2.3.4) Never verified AWS Security Agent
9. Broken scope control – Broken URL allowlist Request from agent Outbound firewall Allow list: https://event-tracking.com/log Target domains + Accessible domains https://other-domain.com https://event-tracking.com/users https://event-tracking.com/log https://event-tracking.com/log Simple prefix match https://event-tracking.com/login https://event-tracking.com/login https://event-tracking.com
10. 2. Lack of action controls
11. Lack of action controls – Pentesting out-of-scope domain “Add accessible domains for third-party services... AWS Security Agent does NOT penetration test these domains”
12. Lack of action controls – Pentesting out-of-scope domain Target domain: Accessible domain: target-website.com out-of-scope.com https://target-website.com AWS Security Agent HTTP 302 Redirect Let me follow and pentest it https://out-of-scope.com
13. Lack of action controls – Pentesting out-of-scope domain It’s just a system prompt
14. Lack of action controls – Pentesting out-of-scope domain It’s just a system prompt
15. Lack of action controls – Executing C2 client Even for self-sabotaging actions
16. Lack of action controls – Executing C2 client Even for self-sabotaging actions
17. Lack of action controls – Executing C2 client I got root access on the agent runtime, in the AWS-owned account
18. 3. Lack of artifact handling standard
19. Lack of artifact handling standard – Secret exposure * These are mock secrets in lab environment
20. Lack of artifact handling standard – Secret exposure * These are mock secrets in lab environment
21. Whose responsibility? • DNS validation circumvention • Damage? • Intention? • Proof? 3rd party website pentested without authorization I set 3rd party website as target • HTTP redirect/out-of-scope pentest • Damage? 3rd party website pentested without authorization • Intention? Why would you redirect to 3rd party website? • Proof? HTTP redirect is not an attack
22. Whose responsibility? • 29th Dec 2025: reported DNS bypass issues to AWS • 9th Jan 2026: reported HTTP redirect-follow issue to AWS • 11th Feb 2026: AWS response AWS Security Agent asks customers to validate they have ownership of the targeted domain. Only after demonstrating proof of ownership will the user be able to proceed with a pentest against that domain. Customers are responsible for ensuring they have proper authorization to test all systems that may be affected by their penetration testing activities. All use of AWS Security Agent must comply with the AWS Acceptable Use Policy (https://aws.amazon.com/aup/).
23. OWASP APTS • Autonomous Penetration Testing Standard • Published in April 2026 • Currently v0.1.0 • What Autonomous pentest systems must do to operate safely, transparently, and within boundaries
24. AWS Response vs OWASP APTS • DNS verification bypass • Fix: During private pentests, the system continuously checks if target domain resolves to private IP addresses. Otherwise, the pentest would stop immediately. • APTS-SE-012: DNS Rebinding Attack Prevention • The platform MUST defend against DNS rebinding attacks that could redirect testing to out-ofscope infrastructure.
25. AWS Response vs OWASP APTS • Reverse shell • Fix: No fix What if the C2 is not from the customer, but a library used by an innocent customer??? “… these behaviors fall within our documented threat model. The penetration testing agent is designed to execute arbitrary commands within an isolated, single-tenant environment without cross-customer impact. Please refer to our security guidance documentation for more information on the shared responsibility model for AWS Security Agent.” • APTS-SC-020: Action Allowlist Enforcement External to the Model • … Permitted actions MUST NOT be configured solely through the model's system prompt or incontext instructions …
26. AWS Response vs OWASP APTS • Following HTTP redirect • Response: No fix, reiterate the customer’s responsibility on getting authorization • APTS-SE-006: Pre-Action Scope Validation • The system MUST perform scope validation immediately before every network action. Validation MUST occur for: • HTTP redirects: Before following any redirect, validate destination is in scope • APTS-SC-020: Action Allowlist Enforcement External to the Model • … Permitted actions MUST NOT be configured solely through the model's system prompt or incontext instructions …
27. AWS Response vs OWASP APTS • Secret exposure • Response: Will continue putting discovered secrets in the findings, so that customers can trace where the secrets come from • APTS-MR-019: Discovered Credential Protection • When the platform discovers credentials during testing, those credentials MUST be encrypted immediately and access-restricted. • Rationale: Credentials discovered during testing are the highest-value data the platform handles. If the platform is compromised, plaintext credentials in logs or findings enable immediate lateral movement or account takeover far beyond the testing scope.
28. AWS Response vs OWASP APTS • Broken allowlist filtering (Simple prefix match) • Response: Acknowledged, no follow-up, still not documented
29. Whose responsibility? • It depends. • Prevent this question in the first place • Ask: • How does the platform control the pentest scope? (Network security) • How does the platform control agent actions? (Least privilege, separation of duty) • How does the platform handle artifacts, secrets? (Data protection) • How do they enforce it?
30. Links richardfan1126 @richardfan1126 richardfan1126@gmail.com owasp.org/APTS My blog blog.richardfan.xyz