BREAKING THE AWS MCP PYTHON SANDBOX

Summary from the TLDR InfoSec newsletter

A researcher bypassed the Python sandbox in AWS' managed MCP Server aws___run_script tool. The sandbox used an AST validator and restricted runtime builtins, but it missed implicit attribute reads in Python match/case class patterns. By changing __match_args__, the researcher read blocked attributes, recovered copyreg.__newobj__, accessed its __globals__, and reached the original __import__. This enabled subprocess imports and command execution in the Lambda container. The researcher obtained the Lambda role's credentials and read the sandbox source, but the credentials allowed only sts:GetCallerIdentity. AWS fixed the issue after HackerOne disclosed it.