English
Español
Français
Deutsch
日本語
한국어
العربيةHijack Bedrock AgentCore interpreter role
Can invoke Python in an AgentCore interpreter and run it as its execution role.
Grants escalation only in combination. All of these are needed together:
bedrock-agentcore:StartCodeInterpreterSessionbedrock-agentcore:InvokeCodeInterpreterbedrock-agentcore:InvokeCodeInterpreter can invoke Python in an AgentCore interpreter and run it as its execution role, but only when it is held together with bedrock-agentcore:StartCodeInterpreterSession. Held together they reach administrator access.
Why it is dangerous
A principal can call bedrock-agentcore:StartCodeInterpreterSession and InvokeCodeInterpreter on an existing Bedrock AgentCore code interpreter that already carries the execution role, and invoke attacker-supplied Python in the session. The interpreter runs that Python in its MicroVM as the target role, no iam:PassRole and no CreateCodeInterpreter needed, because the target role is already bound to the interpreter. The Python reads the target role's live credentials from the MicroVM metadata service or calls AWS directly; if the target role is privileged this is full privilege escalation against an interpreter that was already trusted. Marked needs-verification because AgentCore is a brand-new 2025 service and this is a two-action edge.
In MITRE ATT&CK terms this maps to T1578, Modify Cloud Compute Infrastructure, under the privilege escalation tactic. AWS records it in CloudTrail as StartCodeInterpreterSession, InvokeCodeInterpreter. The call shows up in CloudTrail but blends into normal administration, so it needs a rule to stand out.
Detection
StartCodeInterpreterSessionInvokeCodeInterpreterPrerequisites
An existing AgentCore code interpreter with an execution role attached; permission to start a session and invoke code on it. No iam:PassRole and no CreateCodeInterpreter required, the role is already bound.
MITRE ATT&CK
T1578 · Modify Cloud Compute InfrastructureTactic
Privilege Escalation
A control that would remove it: Restrict bedrock-agentcore:StartCodeInterpreterSession / InvokeCodeInterpreter on interpreters that carry a privileged execution role; scope these actions to specific interpreter ARNs.
Whether to apply it depends on how the permission is used in your environment, so it is a business decision rather than an automatic fix. The same permission can be load-bearing in one account and pure risk in another.
Pathbreak confirms whether this path resolves in your account, ranks it against the others by how much it opens up, and uses your threat model and business context to show which paths are worth cutting.
Questions
What does bedrock-agentcore:InvokeCodeInterpreter allow?
Can invoke Python in an AgentCore interpreter and run it as its execution role.
What else is needed for bedrock-agentcore:InvokeCodeInterpreter to be dangerous?
It becomes an escalation only when held together with bedrock-agentcore:StartCodeInterpreterSession. On its own it is not enough, which is what makes the combination easy to miss.
How is hijack Bedrock AgentCore interpreter role detected?
Watch for StartCodeInterpreterSession, InvokeCodeInterpreter in CloudTrail. The call shows up in CloudTrail but blends into normal administration, so it needs a rule to stand out.
How do you break this path?
A control that would remove it is: Restrict bedrock-agentcore:StartCodeInterpreterSession / InvokeCodeInterpreter on interpreters that carry a privileged execution role; scope these actions to specific interpreter ARNs. Whether to apply it depends on how the permission is used in your account, so it is a business decision rather than an automatic fix.
Which MITRE ATT&CK technique is this?
T1578, Modify Cloud Compute Infrastructure, under the privilege escalation tactic.
Related paths
References
Find this in your own account
We run a read-only scan of one AWS account and show you which of these paths exist, ranked by blast radius, with the change that breaks each one. First validated paths within the hour.