Unit 42 Identifies Prompt Injection Risks in Amazon Bedrock's Multi-Agent Systems

Unit 42 researchers have identified potential security risks in Amazon Bedrock's multi-agent AI systems, particularly concerning prompt injection vulnerabilities. Their study demonstrates how adversaries could exploit inter-agent communication to execute malicious actions, such as disclosing agent instructions and invoking tools with attacker-supplied inputs. The research emphasizes that while Amazon Bedrock itself does not have inherent vulnerabilities, the risk of prompt injection remains a significant challenge for systems relying on large language models (LLMs). The researchers collaborated with Amazon's security team and confirmed that enabling Bedrock's built-in prompt attack Guardrail effectively mitigates these attacks. They recommend a layered defense strategy, including narrow scoping of agent capabilities, rigorous validation of tool inputs, regular security testing, and enforcing least-privilege permissions to enhance the security of multi-agent applications.