What happened
Two related AWS-published bulletins describe the same root cause — missing S3 bucket-ownership verification — in both the DevSecOps Security Agent plugin and its MCP server counterpart, allowing an attacker who pre-registers a specific bucket name to receive the source archive of any workspace scanned by a vulnerable instance.
Why it matters
AI-driven security-scanning agents are being widely adopted for automated vulnerability triage; a flaw that silently exfiltrates full source-code archives (including embedded secrets) to an attacker-controlled bucket undermines the trust model of exactly the tooling meant to improve security posture.
Attack vector
A missing S3 bucket-ownership verification check allows a remote attacker to pre-register a storage bucket that the tool subsequently writes scanned workspace archives to, exposing the private source archive — including any embedded credentials and infrastructure state — of any workspace scanned by an affected instance.
Affected systems
aws-agents-for-devsecops AWS Security Agent plugin, versions before 1.1.0; AWS Security Agent MCP server, versions before 0.2.0
Mitigation
Upgrade aws-agents-for-devsecops to 1.1.0+ and the AWS Security Agent MCP server to 0.2.0+; verify S3 bucket ownership is validated before write in any custom integration. AWS Security Bulletin 2026-105.