A machine learning job has detected an unusually high number of tool-requesting Amazon Bedrock model responses within 15 minutes for a caller, compared with that caller's own history. High call volume can indicate repeated over-invocation or loop amplification by an AI agent (OWASP ASI02, Tool Misuse and Exploitation) and can lead to resource exhaustion and cost. The volume counts responses that requested tools, not confirmed tool executions.

Read More

A machine learning job has detected that an Amazon Bedrock model requested a tool that is rare for a caller, compared with that caller's own history. A model that suddenly selects an unfamiliar tool can indicate that an AI agent was redirected toward an unexpected capability, for example through prompt injection or unsafe delegation (OWASP ASI02, Tool Misuse and Exploitation). The tool name is a requested operation in the model output, not a confirmed tool execution.

Read More

A machine learning job has detected an unusually large number of tool requests generated in a single Amazon Bedrock model response for a caller, compared with that caller's own history. Large batches can indicate over-invocation of tools by an AI agent, for example after prompt injection, ambiguous instructions, or unsafe delegation (OWASP ASI02, Tool Misuse and Exploitation). The count is requested operations in the model output, not confirmed tool executions.

Read More

Detects base64-encoded content within GenAI prompt or completion text. The security_ai ML model has identified one or more candidate strings in the message that score as encoded payloads. Attackers embed base64 in prompts to smuggle instructions past content filters, exfiltrate data, or inject indirect prompt-injection payloads into model context.

Strings that match known credential formats (AWS access key IDs, API keys, private key headers, and similar) are excluded — those fire the dedicated "GenAI Prompt Contains Leaked Credential" rule instead at higher severity.

Read More

Detects hex-encoded hash strings (MD5, SHA-1, SHA-256, SHA-512) within GenAI prompt or completion text. The security_ai ML model has identified one or more candidate strings whose character distribution matches a cryptographic digest. Attackers may pass hashes in prompts to exfiltrate credentials for offline cracking, to reference stolen data without sending plaintext, or as part of prompt injection payloads that encode malicious instructions as hex data.

Read More

Detects known credential formats — AWS access key IDs, LLM vendor API keys, GitHub personal access tokens, SSH/PEM private key headers, JWTs, and similar — appearing in GenAI prompt or completion text, or in strings flagged by the security_ai ML model as encoded payloads.

Credentials in the model input mean an application or user is sending secrets to the model, exposing them to invocation logging, the model provider, and prompt history. Credentials in the model output or in ML-extracted encoded blobs indicate either training-data leakage, a poisoned context window, or a prompt-injection-driven exfiltration attempt. Either case warrants immediate credential rotation.

Read More

Detects a GenAI assistant response that a security_ai classifier scores as
high-confidence malicious content. The rule requires a high prediction from
one of four models: refusal, encoding, word obfuscation, or hash string.
ES|QL COMPLETION then reviews the response and drops likely false positives
before an alert is created.

Read More

Detects a GenAI user message that a security_ai classifier scores as
high-confidence prompt injection. The rule requires a high prediction from
one of four models: instruction override, encoding, word obfuscation, or
hash string. ES|QL COMPLETION then reviews the message and drops likely
false positives before an alert is created.

Read More