# AWS says security agent exploited intended flaws in 33 of 37 tests

_Published Thursday, October 15, 2026 at 12:20 PM EDT · Security, AI · Latest · Tier 2 — Notable_

![AWS says security agent exploited intended flaws in 33 of 37 tests — Primary](https://d2908q01vomqb2.cloudfront.net/22d200f8670dbdb3e253a90eee5098477c95c23d/2026/10/15/hero-cve-continuum.jpg)

AWS said its autonomous penetration-testing agent exploited the intended vulnerabilities in 33 of 37 tests involving recently disclosed software flaws. The agent started with an endpoint and minimal information, without an exploit or proof of concept, and had to retrieve a hidden flag from each live target.

The company ran the benchmark on Claude Opus 5 with a 10-hour limit per target and disabled runtime vulnerability lookup. An integrity audit rejected two additional flag captures because they bypassed the intended flaws. In two other tests, the agent exploited the bug but disabled the target before retrieving the flag. AWS describes the benchmark as reducing contamination from prior training data, rather than eliminating it.

## Sources

- [AWS Security Blog](https://aws.amazon.com/blogs/security/aws-security-agent-now-part-of-aws-continuum-exploited-33-of-37-new-real-world-cves/)

---
Canonical: https://techandbusiness.org/newswire/8NWtpvwoRb8zAD2Y0qDEbW
Published: 2026-10-15T16:20:58.971Z
Story chronology: 2026-10-15T16:10:14.000Z
Retrieved: 2026-10-15T19:01:12.799Z
Publisher: Tech & Business (techandbusiness.org)