AGENTS CRITICAL NEW
AWS Loom 智能体平台：未认证管理员访问及 MCP/A2A 连接器中的 SSRF
AWS 修复了其开源智能体控制平面 Loom 中的一处认证绕过和两处出站请求缺陷，以及 SageMaker Unified Studio 中的一处命令注入。
2026-10-08 // 6 min
阅读完整分析 →
# example prompt — illustrative, defensive
# Defensive check — audit an agent control plane (Loom-style) after a vendor bulletin Report, read-only: - deployed version and whether it is a fixed release - whether an identity provider is configured on every non-loopback deployment - which users and groups hold write scopes for tool servers / remote agents - outbound destinations registered for tool and agent connections: [REDACTED] - credentials the platform stores that must be rotated after upgrade Do not change configuration, rotate, restart or call any endpoint. Output the findings table only.