a newly onboarded caller has little history, so early batches can look unusual until the model has learned its normal range.

security_ai
elastic

Techniques

Sample rules

AWS Bedrock Unusually Large Tool-Request Batch

source: elastic
technicques:

Description

A machine learning job has detected an unusually large number of tool requests generated in a single Amazon Bedrock model response for a caller, compared with that caller’s own history. Large batches can indicate over-invocation of tools by an AI agent, for example after prompt injection, ambiguous instructions, or unsafe delegation (OWASP ASI02, Tool Misuse and Exploitation). The count is requested operations in the model output, not confirmed tool executions.

LoFP / a newly onboarded caller has little history, so early batches can look unusual until the model has learned its normal range.

Techniques

Sample rules

AWS Bedrock Unusually Large Tool-Request Batch

Description

Detection logic