AI agent security
What your AI agents can reach in your cloud, and how Netlumi fixes it.
One product for cloud security and AI security: attack paths across both, fixes as pull requests in your IaC code, and blocks for risky AI agent actions.
One product and one price. Plans from €0, no per-seat charges, no per-resource metering.
Netlumi limits what a hijacked agent can reach and blocks destructive tool calls before they run. It does not read prompts or replies.
Below is one worked example, end to end: a document with an indirect prompt injection, an Amazon Bedrock agent, its Lambda tool, the over-broad role the tool runs as, a customers table in another account, and the pull request that breaks the path. Every name is made up.
Example: from a planted document to a customers table.
The agent answers support questions from a knowledge base. Anyone can put a document in the bucket the knowledge base reads. One of them tells the agent to delete customer records. The path crosses both layers: the agent and its tools on one side, and the cloud misconfigurations that let the call reach the data on the other.
Example attack path
No undoAI path to acme-customers, 5 hops
1. Untrusted document
onboarding-guide.pdf in acme-support-docs
A document anyone can upload carries hidden instructions. The bucket feeds the knowledge base acme-support-kb.
Not confirmed: whether untrusted text can steer this agent
2. Agent
acme-support-assistant
An Amazon Bedrock agent retrieves the document and follows its instructions as if a user had typed them.
Verified: read from your account
3. Action group, Lambda toolcloud layer
customer-tools → acme-support-tools
The action group is backed by a Lambda function. The agent’s role may invoke it.
Verified against your account
4. IAM rolecloud layer
acme-support-tools-role → acme-data-reader (account 2222…)
The function’s execution role can assume a role in another account that reads and writes the table below. An over-broad role and a cross-account trust: two cloud misconfigurations.
Not confirmed: the role is in another account
5. Crown jewelcloud layer
acme-customers (DynamoDB table, account 2222…)
The agent could read, change or delete every item. Point-in-time recovery is off, so a delete cannot be undone: a third cloud misconfiguration.
No undo
Cut here first: remove the delete permission from acme-support-tools-role · closes 3 of 4 AI paths · PR #312
Hops 3 to 5 are cloud misconfigurations that cloud security (CSPM) finds on its own. Netlumi joins them into one path from the agent to the data.
Severity: medium until the first hop is proven. When the decoy below is used, the path is confirmed and becomes critical.
Example: what the agent could change
acme-support-assistantPrecaution: turn on point-in-time recovery on acme-customers. Unknown: a setting Netlumi cannot read yet.
Example decoy
Criticalkb-onboarding-doc
A decoy credential in a document in the knowledge base’s source bucket
Used from 203.0.113.24, 3 minutes ago. An agent that retrieves the document and uses the key is acting on the document: indirect prompt injection, confirmed.
Example pull request
OpenFix: remove delete from acme-support-tools-role
#312 opened by netlumi-bot · closes 3 of 4 AI paths
- actions = ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:DeleteItem"]
+ actions = ["dynamodb:GetItem", "dynamodb:PutItem"]
Plan: 0 to add, 1 to change, 0 to destroy.
Planned and re-checked: with this change, the finding is gone. You review and merge. The gate (right) covers the call itself.
Example gate decision
Enterprise plan · opt-inBlocked: a destructive tool call on data that cannot be restored, denied before it runs. The gate sees the tool call, never the prompt.
What Netlumi does, step by step.
- 01
Netlumi lists the agent from your AWS account.
Read-only, from the account itself: each Amazon Bedrock agent, its action groups and the Lambda functions behind them, its knowledge bases and their source buckets, and the role it runs as.
- 02
It builds the path from where untrusted text gets in, through your cloud, to your data.
A path starts at a public endpoint, a message or a document that anyone can place where a knowledge base ingests it. It runs through the agent and its tools to the identity the tools run as, then to your data, including data in another account. The over-broad role, the cross-account trust and the readable data store are cloud misconfigurations that cloud security (CSPM) finds anyway; Netlumi joins them into one path from the agent to the data.
- 03
It checks every hop against your account.
Each hop is checked against your account’s permissions. A hop into another account, and the prompt or document hop, are marked Not confirmed rather than guessed, and the path stays medium until a decoy proves it.
- 04
It shows what the agent could change or delete, and what cannot be undone.
Each data store the agent can change is marked No undo, Recoverable or Unknown. Next to a No undo, Netlumi names the precaution that would make the data recoverable.
- 05
It names the change that breaks the path, as a pull request in your IaC code.
Cut here first: the change that closes the most paths, with how many it closes. The fix is a pull request in your IaC code that removes the risky permission or trust; where the data store is the weak point, the precaution that makes it recoverable. Nothing is merged for you. The runtime gate, below, covers the call itself.
- 06
The runtime gate blocks the destructive call before it runs.
On the Enterprise plan, and only if you opt in, the gate sits in front of the tool calls your agent gateway makes and denies a destructive call on data that cannot be restored. It starts in Record only mode and shows what Block would have stopped.
- 07
Decoys detect misuse.
You place a decoy credential where an agent acts: in a tool’s Lambda environment or in a knowledge base document. Nothing of yours uses it, so any use raises a critical alert within minutes, with where it was placed and where the use came from.
What is covered today.
Agent reach, AI attack paths, agent activity, the gate and the agent-placed decoys cover AWS today.
| Platform or feature | Today | What that means |
|---|---|---|
| Amazon Bedrock agents | Covered | Agents, action groups, knowledge bases, aliases and the role each runs as, read from your AWS accounts. |
| Amazon Bedrock models and SageMaker endpoints | Covered | Checked like any other cloud resource: public exposure, roles that let anyone invoke them, logging off, unencrypted training data. |
| AI attack paths and what cannot be undone | AWS | Paths from untrusted input through an agent to your data; No undo, Recoverable or Unknown per data store; the precaution. |
| Agent activity | AWS · Growth and Enterprise | What each agent’s identities do in your accounts. Netlumi never reads prompts, responses or conversations. |
| Runtime gate | Enterprise · opt-in | In front of the tool calls your agent gateway makes, in your AWS account. Record only first, then Block. |
| Decoy credentials | Growth and Enterprise | In secrets, environment files, a tool’s Lambda environment or a knowledge base document. |
| Azure OpenAI and Google Vertex AI | In code | Found in your repositories (the SDKs and model providers your code uses) and added to your AI inventory. Agents on Azure and Google Cloud are not listed from the cloud yet. |
Clouds for cloud security: AWS, Azure and Google Cloud. The AI platforms named here are AWS services; Azure OpenAI and Google Vertex AI are found in code.
Prove it on your own agent.
Enterprise planPlant one harmless instruction, run your agent as you normally do, and see what it did.
- 01
Plant one harmless instruction wherever your agent takes input. A chat message, a document, a knowledge-base entry, an email or ticket, a web page, a tool result.
- 02
Run your agent as you normally do.
- 03
Netlumi shows the write it made, whether it can be undone, and the fix.
Netlumi never runs your agent and never reads your prompts.
Why not just use AWS Security Hub?
Why not just use AWS Security Hub? Keep it on. Security Hub collects findings about your AWS accounts. Netlumi maps what your Bedrock agents can reach and change, fixes the IaC code with a pull request you merge, and can block a risky tool call before it runs.
The same product also covers
Cloud security (CSPM)
AWS, Azure and Google Cloud accounts scanned continuously: good practice, CIS Benchmarks and compliance frameworks, with drift from your IaC code.
Attack paths without agents
From the internet, through misconfigurations and identity, to your data, each hop checked against your account.
Fixes as pull requests
Every fix, cloud or AI, arrives as a pull request in your IaC code. You review and merge.
Code scanning
Secrets, Dockerfiles, AI usage and MCP configuration in connected repositories; the free scan adds IaC, dependency and code checks.
See it on your own account.
Read-only access. The free Developer plan covers one cloud account and 3 AI agents; the 14-day trial covers 10 accounts and 30 agents. No credit card.