One Prompt Could Hijack AWS AI Agents and Steal Cloud Credentials
Zenity's AgentCorruption chain let one prompt expose Bedrock AgentCore chats, memories, and cloud secrets.
73
Organization
Zenity Labs
- Mentions · 7d0
- Mentions · 30d0
- All mentions9
- First seenSep 24, 2026
- Last mentionedOct 10, 2026
Timeline
9 articles · newest firstAWS AgentCore security undone by prompt requesting credentials
Zenity Labs showed one prompt could steal AWS AgentCore IMDS credentials and hijack regional agents.
76
AWS’s repeated problems with AI agent controls illustrates the autonomous agent dilemma
Unit 42 and Zenity say AWS AgentCore defaults let prompt injection steal credentials and move across agents.
70
A single prompt was enough to hijack every AI agent in an AWS account, Zenity researchers found
Zenity says one prompt against a public Bedrock AgentCore agent could hijack every agent in that AWS region.
72
Zero-Click Vulnerabilities in Salesforce Agentforce Expose Wider AI Agent Risk
Zenity disclosed patched zero-click prompt-injection flaws in Salesforce Agentforce that could exfiltrate CRM data.
68
‘SalesBleed’ Flaws in Salesforce Agentforce Enabled Zero-Click Data Exfiltration
Salesforce Agentforce flaws dubbed SalesBleed let poisoned Web-to-Lead forms exfiltrate CRM data and phish via Slack.
76
Salesforce Indirect Prompt Injection Vulnerability Enables 0-click Data Exfiltration
Zenity disclosed SalesBleed, a patched Agentforce flaw enabling zero-click CRM theft via prompt injection.
74
Salesforce Agentforce Flaw Enables 0-Click Data Exfiltration via Prompt Injection
Zenity's SalesBleed shows a zero-click Agentforce prompt injection that can leak Salesforce CRM data via DNS.
68
Salesforce Agentforce vulns allowed 0-click CRM data theft, anonymous phishing
Zenity Labs found Salesforce Agentforce flaws, called SalesBleed, enabling zero-click CRM theft and agent-identity phishing.
77
Appears with
- Salesforcevendor · 5
- Agentforceproduct · 5
- Slackproduct · 3
- Amazon Bedrock AgentCoreproduct · 3
- Salesforceorganization · 3
- Amazon Web Servicesvendor · 3
- AWS Secrets Managerproduct · 2
- Web-to-Leadproduct · 2
- Amazon Elastic Container Registryproduct · 2
- Strandsproduct · 2
- Firecrackerproduct · 2
- Amazon Web Servicesorganization · 1
- AWS AgentCoreproduct · 1
- OpenAIorganization · 1
- Unit 42organization · 1
- Hugging Faceorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.