Breaking the AWS MCP Python Sandbox
Source Reddit NetSec
Rated by Threat Radar
Data as of 10/25/2026, 07:05:11 UTC
What to do
AI-suggested
Until an official fix is released, restrict access to the aws___run_script tool to trusted users only and monitor usage for suspicious activity. Consider disabling or limiting the use of the MCP server's script execution capabilities if possible. Follow AWS security best practices for IAM permissions to minimize exposure.
Discussion
A security researcher discovered a method to bypass the AWS MCP Python sandbox restrictions in the aws___run_script tool, which executes user-supplied Python code in a restricted AWS Lambda environment. The sandbox uses AST validation and runtime proxy objects to block dangerous operations, including attribute access and imports. However, the researcher found that Python's structural pattern matching (match/case) can implicitly read attributes listed in __match_args__, bypassing the sandbox's attribute access restrictions. By assigning __match_args__ to sensitive dunder attributes and constructing attribute names at runtime, the researcher achieved sandbox escape and system command execution within the Lambda environment.
r/netsec (opens in a new tab)u/sn1ped_u0 points0 comments
Links cited in the discussion
Impact
The vulnerability allows an attacker with the ability to run Python code in the aws___run_script sandbox to bypass attribute access restrictions and execute arbitrary system commands within the AWS Lambda environment hosting the MCP server. This could lead to unauthorized access to the underlying system, potential privilege escalation, and compromise of the AWS environment associated with the MCP server. The impact is limited to environments where the aws___run_script tool is accessible and the attacker has valid AWS credentials with permission to invoke it.