IAMRAGBENCH: Benchmarking Authorization Expansions in LLM-Generated AWS IAM Policies under RAG Poisoning

Summary

The paper introduces IAMRAGBENCH, a 60-case benchmark testing whether LLMs using retrieval-augmented generation produce AWS IAM policies that exceed trusted authorization requirements when attacker-controlled context is present. Included-context exposure yielded 46 goal-matched attacks out of 292 (15.75%), while presenting the weakening as a final security architecture exception reached 63.79% in a frozen two-endpoint stress test. The authors conclude that IAM copilots should be treated as untrusted proposal generators whose outputs need independent authorization checks before deployment.

Mitigation

The paper proposes a full pre-deployment rule that rejects all 171 exact deltas and routes five unresolved cases to review, and recommends independent authorization checks on IAM copilot outputs before deployment. AWS CheckNoNewAccess reported no new access for only four of 168 goal-matched exact attacks.

Topics

• Retrieval-augmented generation

Related items

• InfoDaybreak Red is now available in AWS GovCloud (US-East)Same vendor · OpenAI Blog
• HighCVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypassSame vendor · AWS Security Bulletins
• InfoMicrosoft named a Leader in the 2026 Gartner® Magic Quadrant™ for AI Agent Management Platforms  Same vendor · Microsoft Security Blog
• MediumCVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP ServerSame vendor · AWS Security Bulletins
• MediumCVE-2026-120497 - Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC WorkflowsSame vendor · AWS Security Bulletins