AWS · Public exploit code

Researcher breaks AWS MCP Server Python sandbox

Oct 28, 2026 · 1 min read

A researcher published a writeup showing how to bypass the Python sandbox restrictions of the AWS MCP Server's aws___run_script tool and achieve system command execution inside the AWS Lambda environment. The managed service lets AI agents call AWS tools. The disclosed material mentions no fix; organizations connecting AI agents to the service should watch AWS advisories.

By HIFY Radar newsroom Updated 10/28/2026 05:41 AM Get this every day →← Back to the feed 1 source

HighVulnerabilityPublic exploit codeFix unconfirmed

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A researcher published a writeup showing how to escape the Python sandbox of the AWS MCP Server's aws___run_script tool. The restrictions can be bypassed to achieve system command execution inside the Lambda environment where the script runs.

Why it matters

The AWS MCP Server is a managed service that lets AI agents call AWS tools. With the bypass, code submitted to the tool escapes the restrictions and gains system command execution in the Lambda environment. Organizations connecting AI agents to the service remain exposed until a fix is disclosed.

What to do

Watch AWS advisories about the AWS MCP Server. Check whether your AI agents use the aws___run_script tool and consider restricting that use until a fix is confirmed.

For the technical team

Affected: AWS (Amazon Web Services) AWS MCP Server, servidor MCP remoto gerenciado (ferramenta aws___run_script) · AWS MCP Server, AWS managed remote MCP server (aws___run_script tool). Versions not stated in the sources.
Exploitation: Technical writeup published on 2026-10-28, announced by the @ptdbugs account on X and hosted on dbugs, describes the full bypass and exploitation chain. The sources report no exploitation in the wild.
Fix: Not stated. The disclosed material mentions no fix or mitigation.
Vector: The aws___run_script tool of the AWS MCP Server accepts a short Python script and runs it in a sandbox on AWS Lambda. There were two layers of protection: a static AST validator that inspected the script's Abstract Syntax Tree and rejected suspicious operations before execution, such as reading dunder attributes (obj.__class__), calling getattr, or importing operator to use operator.attrgetter; and a runtime layer that replaced built-ins with restricted implementations or proxy objects, for example type replaced with _safe_type, which returned restricted proxy classes, open restricted, and getattr blocked. These restrictions can be bypassed to achieve system command execution inside the Lambda environment.
More details: Exploitation chain described: (1) the validator rejected dunder names written as plain strings, so the name was assembled at runtime with chr; (2) defining a class in the sandbox was not possible, but one could be created through collections.namedtuple, which internally uses type(...) and allows __match_args__ to be reassigned; (3) __match_args__ was set to __reduce_ex__; calling this method with pickle protocol 4 returned a recipe for reconstructing the object whose first element was copyreg.__newobj__, a real Python function outside the proxy layer; (4) a function object was needed for isinstance to verify the object was a function. Per the writeup, the script can combine multiple AWS API calls, filter responses, and process the result in a single request.