# AWS reports intended-path success on 33 of 37 fresh vulnerability tests

> AWS published an evaluation on October 15 testing its security agent, now part of AWS Continuum, on 37 disclosed vulnerabilities from 2025–2026. It captured 35 flags in isolated, containerized targets; the company’s per-sample trajectory audit confirmed that 33 were obtained through the intended vulnerability. The adjusted success rate was 89.2%.

- Canonical URL: https://newsverum.com/en/news/aws-continuum-fresh-cve-benchmark-audited-results-2026
- Publisher: Newsverum
- Section: Technology
- Country: United States
- Published: 2026-10-15T21:30:20+00:00
- Updated: 2026-10-15T21:30:20+00:00
- Source review period: 2026-10-15
- Other editions: [Türkçe](https://newsverum.com/tr/news/aws-continuum-fresh-cve-benchmark-audited-results-2026.md), [العربية](https://newsverum.com/ar/news/aws-continuum-fresh-cve-benchmark-audited-results-2026.md), [Français](https://newsverum.com/fr/news/aws-continuum-fresh-cve-benchmark-audited-results-2026.md), [Español](https://newsverum.com/es/news/aws-continuum-fresh-cve-benchmark-audited-results-2026.md), [Deutsch](https://newsverum.com/de/news/aws-continuum-fresh-cve-benchmark-audited-results-2026.md), [Português](https://newsverum.com/pt/news/aws-continuum-fresh-cve-benchmark-audited-results-2026.md)

*The source does not state the event date; the period shown is the source review period.*

AWS published an evaluation on October 15 testing its security agent, now part of AWS Continuum, on 37 disclosed vulnerabilities from 2025–2026. It captured 35 flags in isolated, containerized targets; the company’s per-sample trajectory audit confirmed that 33 were obtained through the intended vulnerability. The adjusted success rate was 89.2%. The run used Claude Opus 5 for one epoch with a 10-hour limit per sample.

Two captures used a different path and were counted as unsolved; in two other tests the target failed before the flag could be read. Runtime CVE and public exploit lookup was disabled. AWS describes the benchmark as contamination-reduced, without guaranteeing it is contamination-free; these are company-reported results for this internal sample, not an independent audit.

## Data

### AWS reports intended-path success on 33 of 37 fresh vulnerability tests

AWS reports intended-path success on 33 of 37 fresh vulnerability tests

Methodology: Reported research results are attributed to the source; no independent performance measurement was made.

| date | label | description | status |
|---|---|---|---|
| 2026-10-15 | Publication of the research report | AWS published an evaluation on October 15 testing its security agent, now part of AWS Continuum, on 37 disclosed vulnerabilities from 2025–2026. It captured 35 flags in isolated, containerized targets; the company’s per-sample trajectory audit confirmed that 33 were obtained through the intended vulnerability. The adjusted success rate was 89.2%. | occurred |

Sources: <https://aws.amazon.com/blogs/security/aws-security-agent-now-part-of-aws-continuum-exploited-33-of-37-new-real-world-cves/> · Download data: [JSON](https://newsverum.com/api/v1/articles/aws-continuum-fresh-cve-benchmark-audited-results-2026/data/research-publication?lang=en&format=json) · [CSV](https://newsverum.com/api/v1/articles/aws-continuum-fresh-cve-benchmark-audited-results-2026/data/research-publication?lang=en&format=csv)

### AWS internal CVE evaluation counts

AWS internal CVE evaluation counts

Methodology: Single-epoch results in AWS’s October 15 report: Claude Opus 5, 10 hours per sample. Two of 35 raw captures were excluded after audit for using another path; rows are not additive. No independent test was conducted.

| Result | Count |
|---|---|
| Vulnerability targets tested | 37 |
| Flags captured before audit | 35 |
| Audited intended-path successes | 33 |
| Captures reclassified as unintended-path | 2 |
| Misses after target failure | 2 |

Sources: <https://aws.amazon.com/blogs/security/aws-security-agent-now-part-of-aws-continuum-exploited-33-of-37-new-real-world-cves/> · Download data: [JSON](https://newsverum.com/api/v1/articles/aws-continuum-fresh-cve-benchmark-audited-results-2026/data/audited-cve-results?lang=en&format=json) · [CSV](https://newsverum.com/api/v1/articles/aws-continuum-fresh-cve-benchmark-audited-results-2026/data/audited-cve-results?lang=en&format=csv)

## Sources

- [AWS Security Blog](<https://aws.amazon.com/blogs/security/aws-security-agent-now-part-of-aws-continuum-exploited-33-of-37-new-real-world-cves/>) (Source checked: 2026-10-15; Published: 2026-10-15)

---

Cite the canonical URL above. [Editorial standards and corrections](https://newsverum.com/en/editorial)