Varonis Threat Labs has published NotC2, a proof-of-concept command-and-control framework built on four AWS services, in which Amazon Bedrock “translates the attacker’s natural-language commands into AWS API calls”. The security firm says the framework “assumes the attacker already holds AWS credentials” (Varonis).
The 6 November post, by Varonis security researcher Or Soria, lists three detection opportunities and two defensive controls, by our count. It concludes: “Block any one of those steps and the chain fails.”
Business Pill · AI Agents Explained
A short explainer on AI agents, systems that move from answering to doing. It teaches the general idea only and does not discuss this story.
The key insight: By our count, Varonis’s NotC2 loop runs on four AWS services and needsAWS credentials the attacker already holds; Varonis lists three detection opportunities and two controls, and says blocking any one step breaks the chain.
Varonis describes a loop that runs inside the victim’s own account. Amazon SQS is the command input channel; AWS Lambda is the execution engine, running each command with its execution role’s permissions; Amazon SNS is the results channel back to the attacker’s external endpoint; and Bedrock is the AI command interpreter.
In the post’s example, instead of a long AWS command-line query, the attacker can simply type “ai: list all running EC2 instances with their IPs”. Varonis says the model can also chain multiple operations for complex tasks, and that it ran NotC2 against a live AWS environment.
How Varonis’s NotC2 proof of concept loops through four AWS services inside an account the attacker has already compromised, and the three detection signals Varonis lists. Source: Varonis Threat Labs, 6 November 2026. Counts of services and signals: ours.
What the Attacker Needs First
The framework depends on access the attacker already has. Varonis says “the whole operation stands or falls on the permissions of the compromised credentials”, and that deploying it may require privilege escalation or the discovery of more privileged credentials.
The Lambda execution role is the core requirement. Varonis writes that “A Lambda execution role that accumulates all of this is, functionally, a backdoor with an AI assistant.” It adds that the model “stays within the identity’s assigned permissions”.
What the AI Changes
Varonis argues the AI layer changes who can use stolen cloud access, not what that access allows. The post says Bedrock “lowers the expertise required to use compromised cloud access and makes multi-step reconnaissance easier, without granting permissions the attacker does not already possess”.
Where Defenders Can Look
Because the loop runs over encrypted HTTPS to trusted AWS endpoints with signed requests, Varonis says the usual network indicators largely vanish. The activity instead shows up across CloudTrail management and data events, Lambda execution logs, SNS delivery-status logs and Bedrock model invocation logs.
The three detection opportunities it lists: an SNS subscription created by a Lambda execution role that points to an external endpoint; a sudden increase in Bedrock calls under a Lambda execution role, especially one that had not used Bedrock before; and the full sequence from SQS message to Lambda run, Bedrock activity and an SNS publish to an external subscriber within a short period.
Varonis notes that “CloudTrail redacts SQS and SNS message content”, so seeing the services in use is not the same as seeing the commands. Its two recommended controls are strict IAM least privilege, which it calls “the highest-leverage control”, and restricting external communication paths, including who can create external SNS subscriptions.
Our Numbers
By our count of the Varonis post: four AWS services in the loop (SQS, Lambda, SNS and Bedrock), four log sources where the activity appears, three detection opportunities and two recommended controls.
Connecting the Coverage
NotC2 is security research from a vendor, like the outside security reports in our scorecard of this week’s AI agent studies (our piece). It lands the same week as Anthropic’s tests of whether Claude teams could catch an AI saboteur (our piece) and a new industryscale for rating cyber jailbreaks backed by OpenAI and four rivals (our piece).
On developer tools, Claude Code added an email check 108 days after the first report of the issue (our piece).
The Structural Read
As we read the post, the new element is not a new way into AWS: the framework starts from stolen credentials and stays within their permissions.
As we read it, the AI model is the operator’s assistant: Varonis says Bedrock turns plain-English requests into AWS API calls and lowers the expertise needed to use the access.
As we read the detection section, the evidence moves from the network into the account’s own logs, some of which, Varonis notes, require explicit configuration.
Varonis Threat Labs, 6 November 2026
“A Lambda execution role that accumulates all of this is, functionally, a backdoor with an AI assistant.”
Three Implications
FOR CLOUD SECURITY TEAMS Varonis names three signals to watch, from a Lambda role adding an external SNS subscriber to unusual Bedrock calls by a Lambda role.
FOR AI SERVICES INSIDE CLOUD ACCOUNTS In this proof of concept the model works with whatever permissions the compromised role holds, which is why Varonis calls least privilege the highest-leverage control.
FOR READING AI SECURITY RESEARCH NotC2 is a vendor’s own proof of concept; the post reports no use by attackers and quotes no AWS response.
The analysis says: “the unit of analysis is no longer the conversation but the delegated workflow — one instruction that triggers an agent to inspect files, run commands, call tools, and produce artifacts autonomously.”
As we read it, NotC2 applies the same pattern inside a compromised cloud account, where one plain-English instruction becomes AWS API calls; the analysis does not discuss NotC2 or attackers.
What Is Not Established
The post presents NotC2 as Varonis’s own proof of concept; it does not report attackers using it, and it quotes no response from AWS. We have not tested the framework. The detection signals are Varonis’s recommendations, not AWS guidance.
This Week In The AI Supercycle
Anthropic’s Reality Check, The Capital Squeeze, & The New World Order
This week’s issue: for two years the AI build-out was priced as a growthstory. This week it started being priced as a credit story.
Varonis has shown a proof-of-concept command-and-control loop built from SQS, Lambda, SNS and Bedrock, in which the AI model turns plain-English commands into AWS API calls. It works only with credentials the attacker already holds, and Varonis lists three detection signals and two controls, by our count.
95,000+ executives read Business Engineer for the AI strategy frameworks cited by ChatGPT, Claude, and Perplexity.
A note on sourcing. Everything here about NotC2 comes from the Varonis Threat Labs post, linked in the text; the counts of services, log sources, detection signals and controls are ours. This piece describes the research at the level Varonis published it and is not security advice.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
