Pwning AgentCore Code Interpreter

Overview AWS Bedrock AgentCore Code Interpreter&rsquo;s &ldquo;Sandbox&rdquo; network mode is supposed to be walled off from the internet. It isn&rsquo;t. Despite a &ldquo;no external network access&rdquo; configuration, the sandboxed interpreter can still issue A and AAAA DNS queries — and that&rsquo;s enough to smuggle a full command-and-control channel out of the sandbox. This project documents…