On October 2, 2026, AWS published bulletin 2026-124-AWS on Loom, its agent orchestration platform. The most serious flaw, CVE-2026-103956 (CVSS 10.0), is a textbook case: if you hadn't configured an identity provider, the system treated everyone as an administrator.
In Loom versions prior to 1.6.1, when neither Amazon Cognito nor an external identity provider was configured, the backend assigned every request a fixed super-administrator identity, without requiring authorization headers. Any client with network reach to the API gained full control of the agent control plane. According to DeepInspect's analysis, that allowed reading and modifying agents, credentials, configuration, and security settings. Other reports add that an attacker could register malicious tool servers and modify the IAM policies of managed roles.
The same bulletin includes CVE-2026-103957 and CVE-2026-103958, which affect versions prior to 1.7.0 and require an authenticated user. In the first, the user could point the OAuth2 discovery URL at an endpoint they control and receive client secrets or access tokens. In the second, they could direct the backend's connections to arbitrary internal addresses and read the responses, opening the door to internal credential services. The bulletin also covers CVE-2026-104019, a command injection in Amazon SageMaker Studio, which is fixed by restarting Spaces.
If any deployment was exposed on the network without an identity provider, assume the control plane may have been compromised. Upgrade to 1.7.0, configure Cognito or an external IdP before exposing the backend, keep the LOOM_ALLOW_UNAUTHENTICATED_LOCAL_DEV variable disabled in production, and rotate OAuth2 client secrets, invalidate tokens in circulation, and rotate the IAM session credentials the platform manages.
The pattern isn't unique to AWS: tools designed for local development ("no auth, just to test") reach production with the permissive mode as the default. On an agent platform the cost is higher than in an ordinary app, because the control plane stores integration credentials and defines which tools agents can invoke. Compromising it is equivalent to compromising everything the agents can touch.
Takeaway for your company: before adopting an agent orchestrator, ask what happens if you don't configure identity (does it fail closed or open?), test that an anonymous request is rejected, and treat the control plane as a critical asset: access only from a private network, rotatable credentials, and logging of every change to agents and tools.
Carlos Montiel is an enterprise AI solutions architect. He implements LLMs, Agents, RAG, and orchestrators for companies across Guatemala and Latin America. Reach out for a consultation.
Contact Carlos Montiel