AWS releases configuration guide for AI vulnerability triage steering files

The AWS security team published a configuration guide for an AI vulnerability triage harness, using a steering file to codify the team's triage methodology as persistent instructions loaded by the model on every session. The guide gives five key configuration sections: first perform structural validation, requiring confirmation that files, functions, data flows, and call paths exist before reporting findings; use a binary signal weighting formula instead of the model's self-reported confidence, with a taint confirmation weight of 0.30; parse IaC and apply multipliers by control type, where attack-blocking controls can stack with a floor of 0.15; incorporate CISA KEV, EPSS, and public PoC signals with a total bonus cap of +0.50; finally, divide scores into four tiers from P0 to P3 for handling. The authors state that without steering, about 30% of findings referenced code structures that did not exist in the repository, and after adding it, no fabricated paths appeared in testing; on a test application with 10 known vulnerabilities, the model found 9 after steering and downgraded two findings mitigated by infrastructure to P3.