The Confused Copilot: Exploring Capabilities and Privilege Boundaries in Amazon Q
Independent Security Researcher
View Profile
Talk Abstract
Amazon Q is increasingly positioned as an AI-powered cloud operations copilot capable of troubleshooting infrastructure, analyzing security posture, investigating failures, and assisting users across AWS environments. While AWS documents some of these capabilities, the exact privilege boundaries, backend access model, and authorization assumptions behind Amazon Q remain largely unexplored.
This research investigates how Amazon Q interacts with AWS APIs, what permissions its internal tools actually require, and whether certain capabilities operate outside the IAM boundaries of the requesting user. By systematically probing Amazon Q’s internal tooling ecosystem — including BillingInspector, InvestigatorCapability, ResourceInspector, SecurityInspector, and others — this work maps the practical trust boundaries between user-controlled IAM identities and Amazon Q’s backend orchestration layer.
The research demonstrates how Amazon Q itself can be repurposed into a “confused copilot” for testing its own authorization model. Through carefully crafted prompts and guided interactions, Amazon Q was coerced into generating permission-boundary test cases, identifying potentially privileged functionality, and assisting in the discovery of undocumented behavior. Particular focus is placed on enhanced-access tooling capable of retrieving billing, cost, metric, and monitoring data even when equivalent IAM permissions were intentionally denied to the user.
The talk will cover methodology, backend behavioral analysis, side-channel style information disclosure risks, practical attack scenarios, and broader lessons for AI-assisted cloud management systems where agentic tooling, delegated authority, and hidden service permissions intersect in unexpected ways.
About the Speaker
Riyaz Walikar
Independent Security Researcher
Riyaz Walikar is a seasoned security researcher, trainer, and offensive security expert with over 15 years of hands-on experience across industry verticals and technology stacks. His work spans Web, API, Mobile, Thick Client, Systems, Internal and Internet-facing Infrastructure, Wireless, Cloud, Containers, Kubernetes, and more recently, Agentic AI and MCP security.
Professionally, Riyaz has led penetration testing and security research teams at Microland, PwC, Citrix, Appsecco, and Kloudle. He now works independently as a full-time security researcher and consultant, while continuing to mentor, teach, and train at conferences and private programs. He has spoken and trained at several leading security and hacker conferences around the world, including Black Hat, DEF CON, OWASP AppSecUSA, nullcon, and c0c0n.
When he is not breaking things or looking under the hood of systems, Riyaz enjoys stargazing, photography, travel, googling easy weight-loss solutions, and cracking terrible jokes in the hope of gaining more followers.
View Profile