AWS reports intended-path success on 33 of 37 fresh vulnerability tests
AWS published an evaluation on October 15 testing its security agent, now part of AWS Continuum, on 37 disclosed vulnerabilities from 2025–2026. It captured 35 flags in isolated, containerized targets; the company’s per-sample trajectory audit confirmed that 33 were obtained through the intended vulnerability. The adjusted success rate was 89.2%.
Source review period: 2026-10-15
Published: · Updated:
The source does not state the event date; the period shown is the source review period.
AWS published an evaluation on October 15 testing its security agent, now part of AWS Continuum, on 37 disclosed vulnerabilities from 2025–2026. It captured 35 flags in isolated, containerized targets; the company’s per-sample trajectory audit confirmed that 33 were obtained through the intended vulnerability. The adjusted success rate was 89.2%. The run used Claude Opus 5 for one epoch with a 10-hour limit per sample.
Two captures used a different path and were counted as unsolved; in two other tests the target failed before the flag could be read. Runtime CVE and public exploit lookup was disabled. AWS describes the benchmark as contamination-reduced, without guaranteeing it is contamination-free; these are company-reported results for this internal sample, not an independent audit.
Data
AWS reports intended-path success on 33 of 37 fresh vulnerability tests
AWS reports intended-path success on 33 of 37 fresh vulnerability tests
- · Occurred
Publication of the research report
AWS published an evaluation on October 15 testing its security agent, now part of AWS Continuum, on 37 disclosed vulnerabilities from 2025–2026. It captured 35 flags in isolated, containerized targets; the company’s per-sample trajectory audit confirmed that 33 were obtained through the intended vulnerability. The adjusted success rate was 89.2%.
Methodology
Reported research results are attributed to the source; no independent performance measurement was made.
Updated:
AWS internal CVE evaluation counts
AWS internal CVE evaluation counts
| Vulnerability targets tested | 37 |
| Flags captured before audit | 35 |
| Audited intended-path successes | 33 |
| Captures reclassified as unintended-path | 2 |
| Misses after target failure | 2 |
Methodology
Single-epoch results in AWS’s October 15 report: Claude Opus 5, 10 hours per sample. Two of 35 raw captures were excluded after audit for using another path; rows are not additive. No independent test was conducted.
Updated:
Subjects and places
Subject proposals
- Science and technologySuggested
- Preserved editorial category/topic; broad candidate onlyaws.amazon.com ↗
Geographic references
Only source-provided geographic references are shown. Opening an external map is optional. Optional story maps use OpenStreetMap. Opening a map sends your IP address and this site’s address to the map provider; location data remains readable as text without loading the map.
- United States · Place role: Coverage · Place type: Country or area · Location precision: RegionalEvidence
- Explicit preserved editorial country/region; no city or national centroid inferredaws.amazon.com ↗