Cross-Tenant Log Injection in AWS Bedrock Agents Leads to Sensitive Data Disclosure
Overview
A security flaw was identified in the logging mechanism for AWS Bedrock Agents that could lead to cross-tenant data leakage. The vulnerability stemmed from improper input sanitization of user-provided data that was subsequently written to an internal, shared log processing service before being routed to customer-specific CloudWatch log streams. An attacker in one AWS account could craft a malicious prompt for their own Bedrock Agent. This prompt would include a specific sequence of Unicode control characters and a partially-formed JSON object. When the Bedrock backend processed this prompt as part of the agent's execution trace, the control characters would confuse the log parser of the shared internal service. This caused the parser to misinterpret log boundaries, leading it to bundle log entries from a subsequent agent invocation—potentially belonging to a different AWS customer—into the attacker's log entry. As a result, the attacker could find sensitive information from other tenants' agent sessions, such as user queries, internal data retrieved by tools, and model responses, appended to their own logs in CloudWatch. The issue was discovered internally by the AWS security team and patched before public disclosure. AWS stated that their internal monitoring detected no evidence of external exploitation of this vulnerability.
Affected Systems
Testing Guide
1. This vulnerability was patched by AWS and is no longer reproducible. There is no method for customers to test for its presence. 2. To review for potential historical impact, you can audit CloudWatch log streams associated with your Bedrock Agents for the period prior to November 15, 2025. 3. Look for log entries that appear malformed, contain data unrelated to your application's context, or have unusual JSON structures.
Mitigation Steps
1. No user action is required. AWS has patched the vulnerability on their backend infrastructure transparently for all customers. 2. It is recommended to review historical CloudWatch logs for any anomalous or unexpected data, particularly between October 2025 and the patch date. 3. Follow the principle of least privilege for the IAM roles assigned to Bedrock Agents, ensuring they only have access to the minimum necessary data and tools. 4. Implement data loss prevention (DLP) scanning on your CloudWatch logs to detect and alert on sensitive data patterns.
Patch Details
The vulnerability was patched by AWS on their backend on November 15, 2025. The patch involved adding stricter sanitization and encoding to all user-controlled input before it enters the internal logging pipeline.