AWS fixed authentication and token flaws in its open-source Loom agent platform
What happened
An AWS security bulletin covers three flaws in Loom, its open-source platform for orchestrating AI agents and MCP tool servers. With no identity provider set, any network client could get full admin access, and two other flaws could leak OAuth tokens or role credentials. The bulletin mentions no attacks.
CVE-2026-103956 affected Loom versions before 1.6.1, where a deployment with no identity provider let any network client gain admin control, register tool servers, read stored integration credentials and rewrite IAM policies on managed agent roles. CVE-2026-103957 let an authenticated user with write scopes point a discovery URL at the backend and cause OAuth2 client secrets or another user's token to be sent out; version 1.6.1 only partly addressed it. CVE-2026-103958 let such a user direct backend requests to internal endpoints, including the container credential service. The bulletin says the issues were found and fixed through coordinated disclosure.
How it happened
Leaky AI product: App flaw. A security flaw in an AI application, such as broken login or access checks, let someone reach data they should not have seen.
The software involved works with many AI models, so no single model maker was involved. The product was Loom, which is open source, a type of AI agent. Vulnerability IDs: CVE-2026-103956, CVE-2026-103957, CVE-2026-103958.
Impact
Data was exposed. Data involved: credentials. There is no evidence that anyone actually accessed the data.
Severity is rated Low, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm. This was a research finding: no real victims are known.
It became public on 2 Oct 2026.
AWS fixed the authentication bypass in 1.6.1, released August 4, 2026, and the other two in 1.7.0. It advises upgrading all deployments and forks to 1.7.0 and, until then, configuring an Amazon Cognito user pool or other identity provider before exposing the backend beyond loopback.