AWS Let 1,000 Agents Attack Its Own Sandbox

Kevin Orellana pointed a coding agent at his own cloud sandbox, told it to break things, and let it run overnight. The AI Engineer talk is his field report on what actually failed when 1,000 autonomous tasks hit Amazon Bedrock AgentCore.

Orellana works on AgentCore, the AWS platform for hosting agents with identity, memory, runtime and gated sandboxes. To mimic how customers use it, his team wrapped the environment in an MCP server, the protocol MCP protocol that frontier models already know, and used it as the agent interface. Findings flowed into a local SQLite store instead of markdown files so multiple sub-agents could run concurrently. They then asked the model to generate 1,000 tests across 10 domains, an arbitrary number meant to cast a wide net, covering sandbox lifecycle, file system IO, performance and software development workflows from ML training to PDF generation to opening a web page.

Three failures show the pattern. An image upload and download returned a different file because the encoding at the MCP layer was incorrect. A null byte, which can be a zero or a string terminator depending on the language, tripped tests. And files written to a specific directory inside the sandbox simply did not persist when retrieved. Orellana said the team began sorting these into two buckets: interface faults and sandbox faults.

The split matters because sandbox-hosted agents do not behave like long-running API services. They download packages, transcode CSV to JSON to PDF, spawn processes and demand different memory, CPU and file permissions per task.

When Orellana compared AgentCore’s two major applications, the code sandbox and the cloud browser, the failure modes clustered around those primitives. Browser tasks that opened many tabs starved the sandbox of memory and killed sessions, a red-flag failure rarely seen in the code interpreter. File system tests hit permissions, mount behavior and ephemeral versus persistent storage. Deeper still are kernel capabilities, seccomp controls and extended BPF programs that can block egress or internal API calls, and even whether Rust binaries or Python modules are in the right path for the agent to execute. AgentCore documents isolated sandboxes with VPC support and robust audit capabilities, plus session-level isolation and automated CAPTCHA handling for the browser, which frames exactly the controls Orellana was stressing against. He noted a recent mitigation: customers can now SSH into a sandbox, not for humans to poke around but for a coding agent to debug its own environment mismatch between local workstation tools and the remote sandbox.

The takeaway was not a patch list but a method. Frontier model scores on SWE-Bench swing wildly with environment controls, one Berkeley study pushed results toward 100% with the right exploits while broken tools collapsed performance, so Orellana argued for fuzzy testing with wide domain coverage remotely, not just locally. No external attacker is required. The agent itself, running with normal permissions, finds the sharp edges.