{"data":{"id":"810cd1da-7bbc-47fb-a194-6f0c0d33ef58","title":"IAMRAGBENCH: Benchmarking Authorization Expansions in LLM-Generated AWS IAM Policies under RAG Poisoning","summary":"The paper introduces IAMRAGBENCH, a 60-case benchmark testing whether LLMs using retrieval-augmented generation produce AWS IAM policies that exceed trusted authorization requirements when attacker-controlled context is present. Included-context exposure yielded 46 goal-matched attacks out of 292 (15.75%), while presenting the weakening as a final security architecture exception reached 63.79% in a frozen two-endpoint stress test. The authors conclude that IAM copilots should be treated as untrusted proposal generators whose outputs need independent authorization checks before deployment.","solution":"The paper proposes a full pre-deployment rule that rejects all 171 exact deltas and routes five unresolved cases to review, and recommends independent authorization checks on IAM copilot outputs before deployment. AWS CheckNoNewAccess reported no new access for only four of 168 goal-matched exact attacks.","labels":["security","research"],"sourceUrl":"https://arxiv.org/abs/2611.03431v1","publishedAt":"2026-11-02T16:52:44.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"info","attackType":["prompt_injection","rag_poisoning"],"issueType":"research","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Amazon"],"affectedVendorsRaw":["AWS IAM","AWS CheckNoNewAccess"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-11-02T16:52:44.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["confidentiality","integrity"],"aiComponentTargeted":"rag","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":"preprint","atlasIds":["AML.T0051","AML.T0070"]}}