AWS releases instructions for evidence-based AI vulnerability triage

AWS released a steering file that directs AI coding assistants to verify code paths before reporting vulnerabilities and to incorporate deployment controls into security priorities. The persistent instructions require confirmed functions, call paths and data flows rather than accepting a model's narrative as evidence. AWS says verification eliminated fabricated paths in its testing. In a purpose-built application containing ten known vulnerabilities, the configured model found nine and documented why two infrastructure-mitigated findings deserved lower priority. It omitted a hardcoded credential defined in unused unit-testing code. AWS describes the confidence weights as a starting point that teams should calibrate against their own labeled findings.