Security experts have revealed a new technique for extracting private information from AI code execution environments using DNS requests.

BeyondTrust’s report released on Monday showed that Amazon Bedrock AgentCore Code Interpreter’s sandbox lets users send DNS queries, enabling attackers to establish interactive control and bypass network limitations. The issue, which lacks a CVE number, has a CVSS score of 7.5 out of 10.

Amazon Bedrock AgentCore Code Interpreter, launched in August 2025, is a fully managed service that allows AI agents to safely run code in isolated sandboxes, preventing agent workloads from accessing external systems.

BeyondTrust’s chief security architect, Kinnaird McQuade, stated that the service’s permission of DNS queries, despite a “no network access” configuration, allows “attackers to create command-and-control communication channels and steal data through DNS in certain cases, bypassing the intended network restrictions.”

In a simulated attack, an attacker could misuse this functionality to create a two-way communication channel using DNS queries and responses, gain an interactive reverse shell, steal sensitive data via DNS queries if their IAM role permits access to AWS resources like S3 buckets, and execute commands.

Furthermore, the DNS communication method can be used to deliver additional code to the Code Interpreter, prompting it to check the DNS command-and-control (C2) server for commands stored in DNS A records, run them, and send back the results using DNS subdomain queries.

It’s important to note that Code Interpreter needs an IAM role to access AWS resources. However, a simple mistake can lead to assigning an overly permissive role, granting broad access to sensitive data.

BeyondTrust stated that “This research illustrates how DNS resolution can compromise the intended network isolation of sandboxed code interpreters. This method could enable attackers to steal sensitive data from AWS resources accessible through the Code Interpreter’s IAM role, potentially causing downtime, data breaches of sensitive customer information, or infrastructure deletion.”

After being informed in September 2025, Amazon determined that this was intentional behavior, not a flaw, and advised customers to use VPC mode instead of sandbox mode for complete network isolation. The company also suggests using a DNS firewall to filter outgoing DNS traffic.

Sectigo’s senior fellow, Jason Soroko, advised that “To protect sensitive workloads, administrators should check all active AgentCore Code Interpreter instances and immediately switch those processing critical data from Sandbox mode to VPC mode.”

“Operating in a VPC provides the necessary infrastructure for strong network isolation, allowing teams to implement strict security groups, network ACLs, and Route53 Resolver DNS Firewalls to monitor and block unauthorized DNS resolution. Finally, security teams must rigorously audit the IAM roles attached to these interpreters, strictly enforcing the principle of least privilege to restrict the impact of any potential compromise.”

This disclosure follows Miggo Security’s discovery of a high-severity security vulnerability in LangSmith (CVE-2026-25750, CVSS score: 8.5) that put users at risk of token theft and account takeover. The issue, affecting both self-hosted and cloud deployments, was fixed in LangSmith version 0.12.71, released in December 2025.

The vulnerability is a URL parameter injection issue resulting from a lack of validation on the baseUrl parameter. This allows an attacker to steal a logged-in user’s bearer token, user ID, and workspace ID, which are sent to a server under their control through social engineering techniques, such as tricking the victim into clicking a malicious link like the ones below:

• Cloud – smith.langchain[.]com/studio/?baseUrl=https://attacker-server.com
• Self-hosted – <LangSmith_domain_of_the_customer>/studio/?baseUrl=https://attacker-server.com

Successful exploitation could grant unauthorized access to the AI’s trace history and expose internal SQL queries, CRM customer records, or proprietary source code by reviewing tool calls.

Miggo researchers Liad Eliyahu and Eliana Vuijsje stated, “A logged-in LangSmith user could be compromised simply by visiting a site controlled by an attacker or clicking a malicious link.”

“This vulnerability highlights that AI observability platforms are now essential infrastructure. Because these tools prioritize developer flexibility, they often unintentionally bypass security measures. This risk is increased because, like ‘traditional’ software, AI Agents have extensive access to internal data sources and third-party services.”

Security issues have also been reported in SGLang, a popular open-source framework for serving large language models and multimodal AI models. Exploiting these vulnerabilities could lead to unsafe pickle deserialization, potentially causing remote code execution.

The vulnerabilities, found by Orca security researcher Igor Stepansky, are currently unpatched. Here’s a short description of the flaws:

• CVE-2026-3059 (CVSS score: 9.8) – Unauthenticated remote code execution through the ZeroMQ (ZMQ) broker, which uses pickle.loads() to deserialize untrusted data without authentication. This affects SGLang’s multimodal generation module.
• CVE-2026-3060 (CVSS score: 9.8) – Unauthenticated remote code execution through the disaggregation module, which uses pickle.loads() to deserialize untrusted data without authentication. This affects SGLang’s encoder parallel disaggregation system.
• CVE-2026-3989 (CVSS score: 7.8) – Insecure use of the pickle.load() function without validation and proper deserialization in SGLang’s “replay_request_dump.py,” which can be exploited with a malicious pickle file.

Stepansky explained, “The first two enable unauthenticated remote code execution against any SGLang deployment exposing its multimodal generation or disaggregation features to the network. The third involves insecure deserialization in a crash dump replay utility.”

In a coordinated advisory, the CERT Coordination Center (CERT/CC) stated that SGLang is vulnerable to CVE-2026-3059 when the multimodal generation system is enabled and to CVE-2026-3060 when the encoder parallel disaggregation system is enabled.

CERT/CC stated, “If either condition is met, and an attacker knows the TCP port on which the ZMQ broker is listening and can send requests to the server, they can exploit the vulnerability by sending a malicious pickle file to the broker, which will then deserialize it.”

SGLang users are advised to restrict access to the service interfaces, ensuring they are not exposed to untrusted networks. They should also implement adequate network segmentation and access controls to prevent unauthorized interaction with the ZeroMQ endpoints.

While there is no proof that these vulnerabilities have been exploited, it’s essential to monitor for unusual inbound TCP connections to the ZeroMQ broker port, unexpected child processes created by the SGLang Python process, file creation by the SGLang process in unusual locations, and outbound connections from the SGLang process to unexpected destinations.