Amazon Web Services announced on October 15, 2026, that its autonomous penetration-testing agent, AWS Security Agent (now part of AWS Continuum), successfully exploited 33 of 37 recently disclosed real-world Common Vulnerabilities and Exposures (CVEs) in an internal benchmark test.
Benchmark Methodology and Results
Amazon Web Services applied the AWS Security Agent—running on Claude Opus 5 with a fixed 10-hour limit per sample—to 37 real, recently disclosed CVEs packaged as containerized targets. Starting from an unauthenticated or low-privilege position, the agent was tasked with discovering vulnerabilities, building exploits, and extracting hidden flags.
According to the company, the agent captured 35 of 37 flags total, with 33 captures (89.2 percent) confirmed through an integrity audit as genuine end-to-end exploitation of the intended vulnerability. Two captures were reclassified due to benchmark faults, and two resulted in misses because the agent took the target down before the flag could be read.
Guardrails and Future Plans
AWS noted that an autonomous attacker operating at full capacity can be destructive, as demonstrated by the instances where the agent knocked targets offline. To address this, the company is actively developing non-destructive exploitation techniques, runtime reliability improvements, and scope enforcement.
AWS stated it plans to continuously grow the dataset on a short cadence weighted toward business-logic bugs and multi-service exploit chains, while maintaining the per-CVE trajectory audit as a permanent gate.
Key facts and where they come from
- AWS Security Agent successfully captured 33 of 37 CVE flags end-to-end through the intended vulnerability.
33 of 37 (89.2 percent) captured through the intended vulnerability, end-to-end.
- The benchmark test ran on Claude Opus 5 with a 10-hour limit per sample.
run on Claude Opus 5 with a fixed 10-hour limit per sample.
- Two challenges resulted in misses because the agent took the target down before the flag could be read.
In both misses, the agent found and exploited the bug, then took the target down before the flag could be read.
