Detecting AWS Bedrock AgentCore Gateway Probing

The AWS Bedrock AgentCore service manages interactions between AI agents and external tools via a Gateway. Detection engineers should be aware that a concentrated burst of failed tool invocations against a single gateway can indicate an adversary performing reconnaissance. Threat actors may probe a tool's parameter surface, testing for injection vulnerabilities, authorization bypasses, or schema weaknesses.

It is essential to distinguish between malicious probing and legitimate operational issues. Because individual tool calls fail routinely due to transient errors or bad input, this behavior only becomes a security concern when high failure rates occur within a short time window. Furthermore, because these gateway error logs do not inherently contain caller identity, confirming the health of the downstream target is critical to separating legitimate infrastructure outages from intentional adversarial probing.

Impact

Successful exploitation of AI agent tool invocation interfaces can lead to unauthorized code execution, sensitive data exfiltration, or the circumvention of security controls implemented within the agent's tool wrapper. If the infrastructure is compromised, attackers may leverage the agent's permissions to interact with internal APIs or databases, leading to potential data breaches or service disruption.

Recommendation

• Deploy monitoring to capture bursts of failed tool invocations using the aws.bedrock_agentcore.gateway.payload_object.isError field.
• Investigate the aws.bedrock_agentcore.gateway.payload_object logs to review stack traces and error types, which helps differentiate between malformed input (probing) and infrastructure outages.
• Confirm gateway target health by reviewing the aws.bedrock_agentcore.gateway.resource_arn and correlating with recent deployment history or credential updates.
• If probing is suspected, review the agent session logs and restrict permissions for the identified gateway target to minimize potential exposure.