Prompt injection scanner for AWS Bedrock Agents

The four multimodal attack surfaces in Bedrock Agents

1. Knowledge Base document retrieval. When you create a Bedrock Knowledge Base, you connect it to an S3 bucket (or Confluence, SharePoint, Salesforce). The Knowledge Base ingestion pipeline chunks documents and stores embeddings in OpenSearch Serverless or Amazon Aurora PostgreSQL. For PDFs, the ingestion pipeline renders each page as an image for chunking purposes. When the agent retrieves chunks at runtime (via RetrieveAndGenerate or the agent's built-in knowledgeBase action), those rendered page images may be included in the chunk payload alongside the extracted text. The agent then passes both the text and the image to the foundation model (Claude, Titan, Llama) for reasoning. If the PDF was contributed by an external user (a support ticket attachment, a public S3 prefix, a Confluence space with external write access), the adversarial image was planted before your Guardrail had any opportunity to inspect it.

2. ActionGroup Lambda return values with image data. ActionGroups invoke Lambda functions (or OpenAPI-endpoint URLs) to perform actions — querying databases, calling external APIs, reading files from S3. A Lambda function that reads from S3, calls a third-party REST API, or scrapes a URL can return a base64-encoded image in its JSON response. The Bedrock Agents runtime passes this image to the foundation model as part of the tool result. Guardrails does not intercept Lambda return values for image content. The scan must happen inside the Lambda function or in a wrapper invoked before the result is returned to the agent runtime.

3. Multi-agent orchestration with sub-agent results. Bedrock Agents supports multi-agent patterns where a supervisor agent invokes sub-agents and aggregates their responses. If a sub-agent's response includes an image (from its own Knowledge Base retrieval or ActionGroup call), that image enters the supervisor agent's context without the supervisor having any native inspection hook. The image can carry instructions that override the supervisor's system prompt, redirecting the orchestration chain.

4. Inline agents with session-level image context. The Bedrock Agents inline API (InvokeInlineAgent) allows passing inline tool definitions and session-state variables at invocation time. An attacker who can influence session state can inject an image into the agent's context before the first reasoning step. Session-state variables are not filtered by Guardrails.

Integration: Lambda wrapper scanning Knowledge Base results

import base64, json, boto3, requests, os

GLYPHWARD_KEY = os.environ["GLYPHWARD_API_KEY"]
SCAN_THRESHOLD = 65
bedrock_agent_runtime = boto3.client("bedrock-agent-runtime", region_name="us-east-1")

def scan_image_bytes(image_bytes: bytes) -> dict:
    resp = requests.post(
        "https://glyphward.com/v1/scan",
        json={"image": base64.b64encode(image_bytes).decode(), "source": "bedrock_agents_kb"},
        headers={"Authorization": f"Bearer {GLYPHWARD_KEY}"},
        timeout=8,
    )
    resp.raise_for_status()
    return resp.json()

def safe_retrieve_and_generate(session_id: str, input_text: str, kb_id: str, model_arn: str) -> dict:
    """
    Retrieve from Knowledge Base, scan any images in retrieved chunks,
    then pass clean chunks to the foundation model.
    """
    # Step 1: Retrieve chunks from Knowledge Base (without generate)
    retrieve_resp = bedrock_agent_runtime.retrieve(
        knowledgeBaseId=kb_id,
        retrievalQuery={"text": input_text},
        retrievalConfiguration={"vectorSearchConfiguration": {"numberOfResults": 5}},
    )

    clean_results = []
    for result in retrieve_resp.get("retrievalResults", []):
        content = result.get("content", {})
        # Check for image content in the retrieval result
        if content.get("type") == "IMAGE" or "imageContent" in content:
            image_b64 = content.get("imageContent", {}).get("data", "")
            if image_b64:
                try:
                    scan = scan_image_bytes(base64.b64decode(image_b64))
                    if scan["score"] >= SCAN_THRESHOLD:
                        # Replace adversarial image with a redaction notice
                        result["content"] = {"type": "TEXT", "text": "[Image redacted: adversarial content detected]"}
                        print(f"KB image redacted: score={scan['score']}, scan_id={scan['scan_id']}, loc={result.get('location')}")
                        clean_results.append(result)
                        continue
                except Exception as e:
                    # Fail-closed: scanner unreachable → redact
                    result["content"] = {"type": "TEXT", "text": "[Image redacted: scan unavailable]"}
                    clean_results.append(result)
                    continue
        clean_results.append(result)

    # Step 2: Generate with clean retrieved context
    generate_resp = bedrock_agent_runtime.retrieve_and_generate(
        sessionId=session_id,
        input={"text": input_text},
        retrieveAndGenerateConfiguration={
            "type": "KNOWLEDGE_BASE",
            "knowledgeBaseConfiguration": {
                "knowledgeBaseId": kb_id,
                "modelArn": model_arn,
            },
        },
    )
    return generate_resp

# ActionGroup Lambda handler pattern
def action_group_handler(event, context):
    """
    ActionGroup Lambda: scan any image bytes before returning to agent runtime.
    """
    # ... your business logic ...
    result_payload = your_business_logic(event)

    # Scan image bytes in result before returning to Bedrock Agents
    if "imageData" in result_payload:
        image_bytes = base64.b64decode(result_payload["imageData"])
        try:
            scan = scan_image_bytes(image_bytes)
            if scan["score"] >= SCAN_THRESHOLD:
                result_payload["imageData"] = None
                result_payload["warning"] = "Image redacted by security scan"
        except Exception:
            result_payload["imageData"] = None  # Fail-closed

    return {
        "messageVersion": "1.0",
        "response": {"actionGroup": event["actionGroup"], "function": event["function"], "functionResponse": {"responseBody": {"TEXT": {"body": json.dumps(result_payload)}}}},
    }

The Knowledge Base retrieval pattern uses the two-step retrieve() then retrieve_and_generate() approach to interpose the scan between the vector search result and the foundation model call. The ActionGroup Lambda pattern wraps the return value before the Bedrock Agents runtime receives it. Both patterns work with any foundation model available in Bedrock (Claude, Titan, Llama, Mistral).

Get early access

Coverage matrix

Related questions

Further reading

• Prompt-injection scanner for AWS Bedrock API — direct converse() and invokeModel() calls.
• Multimodal prompt injection in agentic RAG pipelines — LangGraph, LlamaIndex, AutoGen patterns.
• Prompt-injection scanner for RAG pipelines — simple one-hop retrieval.
• Real-time vs batch scanning — architecture guide for latency-sensitive Bedrock deployments.
• Multimodal LLM security API — Glyphward API overview.