nearfi
Field notes from a little way ahead Week 45 · 6 Nov 2026 · Still early
Agent Index › Coding › AWS Security Agent
Coding · vertical · Standalone · live

AWS Security Agent

Quick answer

AWS Security Agent is a standalone vertical AI agent from Amazon Web Services. An AWS agent that runs penetration tests on your applications, tries to exploit what it finds and reports validated vulnerabilities. Nearfi's Agent Index rates its autonomy 4/5 (multi-step on its own): it runs multi-step attack scenarios on its own and reports validated findings afterwards. The only human gate AWS describes is proving you own the domain, so it is not rated 5, which would need it to act without being pointed at a target. Status: live; 0 incident(s) logged.

By Amazon Web Services · launched 2026-03-31 · last checked 2026-11-06

At a glance
Autonomy
4/5
Multi-step on its own

Why 4: it runs multi-step attack scenarios on its own and reports validated findings afterwards. The only human gate AWS describes is proving you own the domain, so it is not rated 5, which would need it to act without being pointed at a target.

The findings

What it does. It reads source code, design documents, architecture diagrams and infrastructure-as-code to understand an application, then chains weaknesses into attack paths and attempts to exploit them to check they are real. Each finding comes with a CVSS score, severity rating, reproduction steps and remediation suggestions. Before testing starts you prove domain ownership with a DNS record or a verification file.

Where it falls short. Claranet, a UK security firm that had not benchmarked the tool, says agent-led testing is a 'force multiplier, not yet a universal substitute' and notes that standards such as PCI DSS 11.4 and NCSC CHECK still centre on qualified human testers. The AWS pages opened do not say whether individual test runs need approval.

What it can do

codebrowseyour accountsmonitoring

Price: $50 per task-hour per a UK security firm's write-up; AWS's pages give no figure but offer new customers a two-month free trial. · Where: Six AWS Regions: US East (N. Virginia), US West (Oregon), Europe (Ireland), Europe (Frankfurt), Asia Pacific (Sydney) and Asia Pacific (Tokyo). It can test applications on other clouds and on premises. · Surfaces: web, API

Incidents

  • None logged.

Closest fiction

Mr. Robot — An attacker that never sleeps, pointed at your own systems.

Related coding agents

History

  • 2026-11-06 Added to the index.

Sources

  1. AWS Security Agent on-demand penetration testing is now generally available Amazon Web Services, 2026-03-31
  2. AWS Security Agent on-demand penetration testing now generally available AWS Security Blog, 2026-03-31
  3. Autonomous Penetration Testing Agents, AWS Security Agent, and the Compliance Question Claranet

← All agents in the index · Autonomy is rated on what the product does today, on a 1–5 scale. Every fact links to a source.