Arc Security read 43 other AWS accounts' Athena queries by moving one word out of the SQL

The validator and the resolver were reading different fields. StartQueryExecution parses the SQL, and a statement naming the `system` catalog comes back with `Queries of this type are not supported` and no execution ID, so there is nothing to poll ^[6]. The engine then resolves unqualified table names using QueryExecutionContext, which carries `Database` and `Catalog` ^[7]. Arc Security left the catalog out of the statement, put `Catalog=system` beside it, and the query ran ^[8]. What answered was Trino's `system.runtime.queries`, which on Athena engine v3 holds query ID, submitting user, state, timing and full SQL text ^[5]. "It worked because the check that was supposed to stop us was reading the SQL, and the access did not arrive through the SQL," Arc wrote ^[9].

Even with no customer rows returned, the statement text alone is enough. A filter on an email address contains that email address, and an `INSERT` spells out every field of the row somebody just wrote ^[11]. Table names, columns, joins and the choice of filter describe how a business models its operations and what it collects ^[12]. Arc's summary of the value: "If you were planning to spend real effort on a company, an hour of their analysts' queries is a better map than most of their internal documentation" ^[13].

`system.runtime.queries` itself was intact and unchanged ^[14]. Athena engine v3 queries do not necessarily run on dedicated single-tenant infrastructure, so a Trino diagnostic table designed for the operator of a cluster was answering for whoever else was on it ^[14]. The rows Arc got back carried statement text, the submitting account ID, run time and completion state for accounts with no shared resource and no grant in either direction ^[10].

The four days between report and global fix measure AWS's remediation. On Arc's dates that puts the fix on or about 10 August 2026 ^[15]. The writeup gives no date for when `Catalog` in the context first resolved `system`, so the length of the exposure is not established anywhere in the record ^[16].

The record stops here. Arc says no customer action is required ^[1]. The writeup does not say whether AWS told the accounts whose statements came back, and it describes no way for a tenant to check retroactively whether its own statement text was read by someone else ^[17]. There is no AWS statement in the material at all, so the disclosure timeline, the scope and the fix are Arc's telling of them ^[18]. Arc's headline counts 43 other AWS accounts; the body counts queries from 43 separate identities in a single response ^[4][3].