Breaking the AWS MCP Python Sandbox (xplo1t-sec.github.io)

AWS recently announced the general availability of its managed Model Context Protocol (MCP) Server, enhancing the capabilities of AI agents like Claude Code and Cursor by allowing them to execute Python scripts in a secure, server-side sandbox via the new `aws___run_script` tool. This tool simplifies workflows by enabling agents to make multiple AWS API calls and process results in a single request, significantly improving efficiency for tasks such as managing AWS resources. However, a security vulnerability was discovered that allows for potential exploitation within this sandbox. A researcher successfully bypassed the imposed restrictions on Python code execution by leveraging Python's structural pattern matching, introduced in version 3.10. The attacker manipulated the attributes exposed by class patterns in a way that the MCP's static and runtime protections failed to detect. By controlling attribute access through adjustments to Python's `__match_args__`, the researcher was able to execute system commands, raising serious concerns about the security of user-supplied code in AWS's environment. This incident underlines the importance of rigorous security assessments in AI frameworks and the ongoing need for robust safeguards against similar vulnerabilities.