Loom for AWS handed full agent control to anyone without an identity provider

On 2 October 2026, AWS shipped four fixes for Loom, its open-source AI agent orchestration platform, and for SageMaker Unified Studio. The most severe, CVE-2026-103956, gives any network client full administrative control of the agent control plane when no identity provider is configured — a lesson that applies to every MCP or A2A deployment.