AI agent security
What your AI agents can reach in your cloud, and how Netlumi fixes it.
One product for cloud security and AI security: attack paths across both, fixes as pull requests in your IaC code, and blocks for risky AI agent actions.
One product and one price. No per-seat charges, no per-resource metering.
Netlumi limits what a hijacked agent can reach and blocks destructive tool calls before they run. It does not read prompts or replies.
Below is one worked example, end to end: a document with an indirect prompt injection, an Amazon Bedrock agent, its tool, the over-broad role the tool runs as, a customers table in another account, and the pull request that breaks the path. Every name is made up.
Worked example
Example: from a planted document to a customers table.
The agent answers support questions from a knowledge base. Anyone can put a document in the bucket the knowledge base reads. One of them tells the agent to delete customer records. The path crosses both layers: the agent and its tools on one side, and the cloud misconfigurations that let the call reach the data on the other.
Example attack path
Cannot be restoredAI path to acme-customers, 5 steps
1. Untrusted document
onboarding-guide.pdf in acme-support-docs
A document anyone can upload carries hidden instructions. The bucket feeds the knowledge base acme-support-kb.
Unproven
2. Agent
acme-support-assistant
An Amazon Bedrock agent retrieves the document and follows its instructions as if a user had typed them.
Proven
3. Agent toolcloud layer
customer-tools → acme-support-tools
The agent can call this tool.
Proven
4. IAM rolecloud layer
acme-support-tools-role → acme-data-reader (account 2222…)
The tool can act as a role in another account that reads and writes the table below. An over-broad role and a cross-account trust: two cloud misconfigurations.
Unproven
5. Crown jewelcloud layer
acme-customers (DynamoDB table, account 2222…)
The agent could read, change or delete every item, and a deleted item could not be restored: a third cloud misconfiguration.
Cannot be restored
Cut here first: remove the delete permission from acme-support-tools-role · closes 3 of 4 AI paths · PR #312
Steps 3 to 5 are cloud misconfigurations that cloud security (CSPM) finds on its own. Netlumi shows them as one path from the agent to the data.
Severity: rises when Netlumi has proof that the path can be used.
Example decoy
Criticalkb-onboarding-doc
A decoy set up for acme-support-assistant
Used from 203.0.113.24, 3 minutes ago. The agent was steered by something it read: indirect prompt injection, confirmed.
Example pull request
OpenFix: remove delete from acme-support-tools-role
#312 opened by netlumi-bot · closes 3 of 4 AI paths
- actions = ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:DeleteItem"]
+ actions = ["dynamodb:GetItem", "dynamodb:PutItem"]
Plan: 0 to add, 1 to change, 0 to destroy.
Checked: with this change, the finding is gone. You review and merge. The gate (below) can stop the action itself.
Example gate decision
Business and Enterprise plans · opt-inBlocked: an action that would destroy data you cannot restore. Netlumi never reads the prompt.
The same gate, as a picture
Step by step
What Netlumi does, step by step.
Netlumi lists the agent from your AWS account.
Read-only, from the account itself: each Amazon Bedrock agent, its tools, its knowledge bases and the role it runs as.
It shows the path from where untrusted text gets in, through your cloud, to your data.
A path starts where untrusted text can reach the agent: a public endpoint, a message or a document. It runs through the agent and its tools to your data, including data in another account. The over-broad role, the cross-account trust and the readable data store are cloud misconfigurations that cloud security (CSPM) finds anyway; Netlumi shows them as one path from the agent to the data.
It shows what it has confirmed.
Netlumi shows which steps of a path it has confirmed in your account and which it has not, and why. Severity rises when Netlumi has proof that the path can be used.
It shows what the agent could change or delete, and what cannot be undone.
Netlumi tells you which data an agent could change that you could not get back, and what to do first.
It names the change that breaks the path, as a pull request in your IaC code.
Cut here first: the change that closes the most paths, with how many it closes. The fix is a pull request in your IaC code that removes the risky permission or trust, or the precaution that makes the data recoverable. Nothing is merged for you. The optional gate, below, can stop the action itself.
An optional gate stops destructive actions.
On the Business and Enterprise plans, an optional gate can stop an agent action that would destroy data you cannot restore. You can run it in record-only mode first.
Decoys detect misuse.
Decoys tell you within minutes if an agent is being steered by something it read.
Coverage
What is covered today.
Agent reach, AI attack paths, agent activity, the gate and decoys cover AWS today.
| Platform or feature | Today | What that means |
|---|---|---|
| Amazon Bedrock agents | Covered | Agents, action groups, knowledge bases, aliases and the role each runs as, read from your AWS accounts. |
| Amazon Bedrock models and SageMaker endpoints | Covered | Checked like any other cloud resource: public exposure, roles that let anyone invoke them, logging off, unencrypted training data. |
| AI attack paths and what cannot be undone | AWS | Paths from untrusted input through an agent to your data, which data could not be restored, and what to do first. |
| Agent activity | AWS · Growth, Business and Enterprise | What each agent’s identities do in your accounts. Netlumi never reads prompts, responses or conversations. |
| Runtime gate | Business and Enterprise · opt-in | Can stop an agent action that would destroy data you cannot restore. You can run it in record-only mode first. |
| Decoys | Growth, Business and Enterprise | Tell you within minutes if an agent is being steered by something it read. |
| Azure OpenAI and Google Vertex AI | In code | Found in your repositories (the SDKs and model providers your code uses) and added to your AI inventory. Agents on Azure and Google Cloud are not listed from the cloud yet. |
Clouds for cloud security: AWS, Azure and Google Cloud. The AI platforms named here are AWS services; Azure OpenAI and Google Vertex AI are found in code.
Prove it
Prove it on your own agent.
Plant one harmless instruction, run your agent as you normally do, and see what it did.
Plant it
Plant one harmless instruction wherever your agent takes input. A chat message, a document, a knowledge-base entry, an email or ticket, a web page, a tool result.
Run it
Run your agent as you normally do.
See what it did
Netlumi shows the write it made, whether it can be undone, and the fix.
Netlumi never runs your agent and never reads your prompts.
Why not just use AWS Security Hub?
Why not just use AWS Security Hub? Keep it on. Security Hub collects findings about your AWS accounts. Netlumi maps what your Bedrock agents can reach and change, fixes the IaC code with a pull request you merge, and can block a risky tool call before it runs.
One product
The same product also covers
Cloud security (CSPM)
AWS, Azure and Google Cloud accounts scanned continuously: good practice, CIS Benchmarks and compliance frameworks, with drift from your IaC code.
Attack paths without agents
From the internet, through misconfigurations and identity, to your data: the paths that are real in your account.
Fixes as pull requests
Every fix, cloud or AI, arrives as a pull request in your IaC code. You review and merge.
Code scanning
Secrets, Dockerfiles, AI usage and MCP configuration in connected repositories; the free scan adds IaC, dependency and code checks.
See it on your own account.
Read-only access. The free Developer plan covers one cloud account and 3 AI agents; the 14-day trial covers 10 accounts and 30 agents. No credit card.