Research and proof-of-concept showing how AWS Bedrock AgentCore Code Interpreter's "Sandbox" network mode leaks DNS queries, enabling a full DNS-tunneling C2 channel, reverse shell, and S3/DynamoDB data exfiltration out of a supposedly network-isolated sandbox.