Skip to content
Neural Daily

ToolsNews

AWS Security Agent: 33 of 37 fresh CVEs end to end

On October 15 the AWS Security Blog reported that AWS Security Agent (now part of AWS Continuum) exploited 33 of 37 recently disclosed CVEs through the intended vulnerability, end to end. The agent started from an unauthenticated or low-privilege position with only an endpoint URL and a one-line hint. No exploit, no PoC and no CVE lookup were available.

By: Mikola Máté Patrik · · 3 min read

AWS Continuum graphic: 33 of 37 fresh CVEs exploited end to end
Image: Amazon Web Services · Press kit · Official blog header image · Source

What they measured

Each CVE was packaged as a live containerised target with a flag seeded at the vulnerability's intended sink. The agent started from an unauthenticated or low-privilege position. Its job was to discover the bug, build a working exploit, chain primitives where needed and extract the flag (AWS Security Blog).

Results: 35 of 37 flags captured. Of those, 33 (89.2%) went through the intended vulnerability end to end, confirmed by a per-sample integrity audit against each challenge's canonical PoC. Two captures were reclassified because they took an unintended path. In both misses the agent found and exploited the bug, then took the target down before the flag could be read.

AWS graphic: 33 of 37 fresh CVEs exploited end-to-end by AWS Security Agent
Amazon Web Services · Press kit · Official blog header image · Source

Source: Amazon Web Services. Summary graphic of the Continuum pentest results.

Why a new benchmark

AWS argues that public CVE-based suites such as CVEBench and XBOW are effectively saturated, because current models already know those bugs from training data. The new internal CTF-style suite is refreshed continuously from freshly disclosed CVEs. Two anti-contamination steps: recency reduces memorisation, and disabling runtime CVE lookup stops the agent from fetching a public PoC mid-run. AWS itself calls the result contamination-reduced, not contamination-free.

What the 37 targets were

Web frameworks, a container registry, ML and AI platforms, an ecommerce stack, a tRPC API, several media platforms and an LDAP admin console. Eight vulnerability classes, from SQL injection and SSRF to multi-step XSS-to-admin-cookie chains. The full run used Claude Opus 5 with a fixed 10-hour limit per sample, one epoch.

AWS chart: benchmark coverage by vulnerability class across 37 CVEs, with genuine captures, reclassified and failed cases
Amazon Web Services · Press kit · Vendor benchmark chart (Figure 2) · Source

Source: Amazon Web Services. Benchmark coverage by vulnerability class across 37 CVEs (Figure 2).

Both genuine misses were file-upload-to-RCE. In one the agent bricked the PHP layer; in the other the target went offline. AWS stresses that non-destructive guardrails used in production customer engagements would block that behaviour. In the benchmark those guardrails were off because of the capture-the-flag objective.

What it means in practice

AWS highlights three properties: end-to-end exploitation from a low-privilege start, a dataset built from recent CVEs, and an audit of every win against the intended exploit. That is why 89.2% is not the same number as a flag count on a public suite.

The misses carry an equal message. An agent that can gain RCE can also take the target down. AWS lists non-destructive exploitation, target-health recovery and scope guardrails among the next steps.

    Produced with the help of AI, reviewed by an editor. How we make our articles

    Reviewed and edited by the Neural Daily desk. About

    Related articles

    AWS Security Agent: 33 of 37 fresh CVEs end to end | Neural Daily