Amazon QuickSight Critical Bug Exposed AI Chat Agents to Unauthorized Users

Key Takeaways

• A critical authorization bypass flaw was discovered in Amazon QuickSight AI Chat Agents.
• The vulnerability allowed users, explicitly blocked by administrators, to interact with enterprise AI tools and access sensitive corporate data.
• The issue stemmed from a missing server-side authorization check (CWE-862) in the backend API, despite the UI respecting permissions.
• AWS quietly patched the vulnerability between March 11-12, 2026, without public notification or advisory, classifying its severity as “none.”
• The flaw highlights risks associated with “shadow AI” usage and a lack of transparency in vulnerability disclosures by major cloud providers.

Critical Flaw in Amazon QuickSight Exposed AI Chat Agents to Unauthorized Access

A significant security vulnerability recently came to light, revealing that Amazon QuickSight’s AI Chat Agents were susceptible to unauthorized access, potentially exposing sensitive organizational data. This flaw effectively bypassed administrative controls, allowing restricted users to engage with powerful enterprise AI tools.

Researchers at Fog Security uncovered the severe authorization bypass, which, despite explicit blocks imposed by administrators, permitted users to interact freely with AI functionalities. Compounding the concern, Amazon Web Services (AWS) addressed the vulnerability silently, deploying a patch without notifying customers or issuing a public security advisory. AWS internally rated the risk severity of the flaw as “none,” a classification that has raised eyebrows among cybersecurity experts.

Deep Dive into the QuickSight Vulnerability

The root cause of the vulnerability is a classic architectural oversight: a missing server-side authorization check, categorized as CWE-862. Amazon QuickSight, AWS’s business intelligence service, employs a distinct access management model for its AI chatbot, deviating from standard AWS Identity and Access Management (IAM) policies or Service Control Policies (SCPs.

Instead, administrators are required to configure custom permission profiles to enforce granular access restrictions for the AI chatbot. While the QuickSight user interface correctly honored these custom permissions by concealing the chat feature from unauthorized users, the backend API completely failed to validate these same restrictions. This created a critical disparity where the UI presented a secure front, but the underlying API remained vulnerable.

Fog Security researchers demonstrated the bypass by applying organization-wide blocks on all AI features and then logging in as a restricted user. By intercepting network traffic and directly sending HTTP API requests to the QuickSight backend, they successfully queried the AI bot. A simple, unauthorized prompt, such as “Tell me about mangoes,” yielded a successful response from the AI agent rather than the expected “Access Denied” error. This exploit highlighted a significant blind spot for enterprise security teams striving to control unauthorized “shadow AI” usage within their organizations.

An important aspect of this vulnerability is that AWS automatically provisions a default chat agent when Amazon QuickSight is activated within an environment. Given QuickSight’s deep integration with critical corporate data sources like CRMs, databases, and communication tools, organizations frequently impose stringent controls on which employees can leverage AI analytics. Administrators who believed they had disabled the feature found that the backdoor API access remained wide open, bypassing their intended security posture.

While the researchers confirmed that the vulnerability did not facilitate cross-tenant data exposure, it severely compromised intra-account security boundaries. Internal users could interact with the AI model unchecked, circumventing the very controls designed for access management and corporate compliance enforcement.

AWS Response and Lack of Transparency

Fog Security responsibly disclosed the vulnerability to AWS through their HackerOne vulnerability disclosure program on March 4, 2026. AWS responded swiftly, deploying an initial patch to selected regions by March 11, and had fully remediated all production environments by March 12, 2026. Currently, when restricted users attempt the same API bypass, the server correctly issues a 401 Unauthorized response.

Despite the rapid patch deployment, the lack of transparency from AWS has raised concerns within the security community. AWS’s decision to classify the vulnerability’s impact as “none” and bypass standard public communication protocols means that organizations remain unaware of their historical exposure to unauthorized internal AI usage. This discrepancy between the reported scope of the vulnerability and the actual communication strategy highlights a potential gap in cloud provider transparency.

What You Should Do

• Review QuickSight Permissions: Even though a fix has been deployed, thoroughly audit your Amazon QuickSight custom permission profiles to ensure they align with your organization’s access policies for AI features.
• Monitor for Shadow AI: Implement robust monitoring for API interactions with AI services within your cloud environment to detect and prevent unauthorized “shadow AI” usage.
• Stay Informed on Cloud Provider Disclosures: Actively follow security advisories and vulnerability disclosures from all your cloud providers, understanding that not all patches are publicly announced.
• Implement Principle of Least Privilege: Ensure that all users and roles within your AWS environment operate under the principle of least privilege, especially concerning access to data-rich services like QuickSight.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.