How I Trained the Best 2B Strands Decider: Beating the Official Strands Model and the 2B Leaders, Top 3 in Text, Image and Multimodal

In 2019, a former cloud software engineer breached Capital One’s AWS environment, compromising over 100 million customer records.The Entry: The attacker exploited an unpatched Server-Side Request Forgery (SSRF) flaw in an open-source Web Application Firewall (WAF) running on an EC2 instance.The Privilege: The compromised EC2 instance had an attached IAM role with excessive read permissions to AWS S3.The Extraction: Querying the AWS Instance Metadata Service (IMDSv1) via SSRF leaked the role’s temporary STS credentials. The attacker used standard AWS CLI commands to sync and exfiltrate over 700 S3 buckets of sensitive financial data.The Fallout: Over $80 million in regulatory fines, hundreds of millions in remediation costs, and an industry-wide push by AWS to release IMDSv2, which requires session-oriented token headers to neutralize SSRF metadata theft