REPORTED DEVELOPMENT
AWS's official security bulletin describes CVE-2026-115845. An authenticated user could submit crafted Python through run_script, bypass incomplete negative-list validation and execute code within that user's own isolated session.
AWS says the issue was fixed service-side and requires no customer action. This is a vendor disclosure, not independent evidence of exploitation or a cross-tenant breach.
WHY IT MATTERS TO THE MARKET
Code-validation controls and session-isolation boundaries are distinct; the described scope should not be expanded into unsupported claims about other users' data.