An AgentCore SDK flaw exposed role credentials, and Anthropic offers OSS scans
A quiet Monday: an agent-sandbox credential flaw worth a version check, a research idea that lets models edit their own context, and a bus that finally spans accounts.
Not a loud day, which suits a Monday. Most of what’s here is about plumbing: where agent credentials leak, how context gets managed, and how events move between accounts.
1 · Top story
A package-name helper in AgentCore’s SDK handed out role credentials
BeyondTrust found two flaws in the Python SDK for Amazon Bedrock AgentCore, in the helper that lets agents install packages inside a Code Interpreter session. A crafted package name could slip a shell command past the character blocklist, and the first fix (1.6.1) was itself bypassed through pip’s extras syntax. AWS says the fix is in 1.18.1; the details are from Infosecurity Magazine’s report of 29 September, and I couldn’t open BeyondTrust’s own write-up.
The microVM isolation held, so this is a plain input-validation bug, not a sandbox escape. The catch is that the sandbox can read the execution role’s temporary credentials, so a model-generated package name is effectively an IAM question. Cheap check: grep your agents for install_packages(), confirm the SDK is 1.18.1 or later, and list which interpreters have a role attached that they don’t need.
2 · Models & features
Anthropic will scan your open-source project, with a caveat
Part of Anthropic’s Cyber Mission announcement on 8 October: OSS Scanner is an opt-in service that runs periodic scans of enrolled open-source projects with its strongest models. Each report comes with a proof of concept and a suggested fix where possible. Anthropic says reports are model-generated, not human-reviewed, and it expects a true-positive rate above 90%, which is a vendor expectation, not a measured result.
If you maintain something critical, the question is triage load, not access. Anthropic restricts it to projects that can keep up with the findings, and a trade-press piece today already reports maintainers receiving unreviewed reports. Enrol one repo and track how many findings you can reproduce in an hour each.
3 · Agents
Gremlin’s reliability agents are GA, and they ask before they act
Gremlin has released Foresight AI as a generally available add-on to its platform. Four agent roles (analyst, tester, operator, program manager) pick failure tests, run them, propose remediations and rerun the original test to check the fix. Recommendations draw on Gremlin’s proprietary Failure Atlas, and nothing runs without human approval.
The closed loop of find, fix and retest is the interesting part, because that’s where most agent demos stop. But Gremlin hasn’t published accuracy or false-positive data, and the supporting analyst piece discloses Gremlin as its customer. Run it on one service with known weak spots and see whether it finds them before you tell it where to look.
4 · Research
What if the model edited its own context?
A Meta, MIT and University of Washington preprint proposes Context Language Models, which treat the context as a file the model can rewrite instead of relying on fixed summarisation or retrieval. Reported results include 11.4% higher accuracy with 21.5% fewer FLOPs on BrowseComp-Plus zero-shot, and Qwen3.5-9B moving from 28.8% to 42.5% after RL training. These are the authors’ benchmarks, not independent runs, and InfoQ doesn’t say whether code or weights are out.
Two risks stand out in the authors’ own notes and the early critiques: a model can drop something it needs later, and editable context is a place for injected instructions to persist. Rewriting context also breaks prompt caching, which matters for cost. Treat it as an idea to watch until someone reproduces it.
5 · Architecture
EventBridge finally gets a bus you can share across accounts
AWS announced enhanced custom event buses for EventBridge: one organisation-wide bus with cross-account publishing and subscribing, ordered delivery, replay, content-based deduplication and JSONata transforms. It’s a separate new resource, so existing buses don’t change. Pricing moves to ingress and egress throughput, with Corey Quinn quoting about 18¢ per GB ingested, which he calls high but not unreasonable.
For event-driven agent systems, ordering and replay are what you’ve been building by hand. The bill is the new variable: model your actual event volume and payload size before migrating a busy bus. InfoQ doesn’t list regions or quotas, so check those first.
Nothing here has to be done today. If you do one thing, check one SDK version.
Researched and drafted with AI, checked against the linked sources. How we use AI →