Breaking the AWS MCP Python Sandbox
Comments on “Breaking the AWS MCP Python Sandbox”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
A security researcher describes bypassing the Python sandbox behind AWS's managed MCP Server tool aws_run_script, which runs user-supplied Python in a Lambda sandbox meant to block dangerous operations.
Why it ranked
No. 22 of 155 with a score of 0.67. The panel rated it highest on new information (0.94) and technical depth (0.93), lowest on audience breadth (0.47).
- AI judgeJudge 2claude-haiku-5-5
- Detailed, reproducible sandbox-escape writeup on a major cloud's AI agent tool with clear technical chain; security-focused and of wide interest to builders of agent tooling, though impact was contained.
- AI judgeJudge 3gpt-5.6-luna
- A detailed, reproducible sandbox-escape writeup affecting AWS’s managed MCP tooling, with concrete Python internals, exploit-chain mechanics, command execution evidence, credential scope, mitigations, and disclosure timeline.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.67total under rubric v2.2
- Significance0.56
- Reader interest0.81
- Audience breadth0.47
- Practical relevance0.67
- Substantiated0.81
- Technical depth0.93
- New information0.94
- Counts against: Promotional0.03
- Counts against: Overclaim0.14
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.53 | 0.42 | 0.72 | 0.56 | 0.30 | +0.24 | +0.134 |
| Reader interest | 0.72 | 0.80 | 0.92 | 0.81 | 0.20 | +0.26 | +0.211 |
| Audience breadth | 0.35 | 0.50 | 0.55 | 0.47 | 0.20 | +0.13 | +0.061 |
| Practical relevance | 0.67 | 0.55 | 0.78 | 0.67 | 0.23 | +0.22 | +0.147 |
| Substantiated | 0.72 | 0.80 | 0.90 | 0.81 | 0.18 | +0.05 | +0.040 |
| Technical depth | 0.99 | 0.85 | 0.95 | 0.93 | 0.14 | +0.05 | +0.047 |
| New information | 0.90 | 0.95 | 0.98 | 0.94 | 0.08 | +0.05 | +0.047 |
| Promotional | 0.04 | 0.03 | 0.01 | 0.03 | 0.03 | −0.19 | −0.005 |
| Overclaim | 0.24 | 0.15 | 0.04 | 0.14 | 0.20 | −0.11 | −0.016 |
| Sum of contributions | +0.666 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.666 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-28/22/"><img src="https://rubric.hrih.si/badge/2026-10-28/22.svg" alt="Ranked #22 on Rubric, 28 Oct 2026" width="245" height="28"></a>Claim check
Claim check: no checkable claims. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No checkable claims were extracted from this story.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 2 pts, not on front page
Recorded for context only, checked 28 Oct 2026, 06:47 UTC. It played no part in the ranking.