Amazon Elastic Container Registry (Product): news timeline & CVEs

AWS Bedrock AgentCore Flaw Allowed Attackers to Hijack AI Agents Using a Single Prompt

Zenity showed one prompt could steal Bedrock AgentCore credentials and reach other agents in the account.

Zenity disclosed AgentCorruption, a chain against Amazon Bedrock AgentCore in which one prompt told an agent with HTTP or shell tools to query the microVM metadata service at 169.254.169.254. The service returned temporary execution-role credentials that researchers exported and used directly through AWS APIs. Zenity said the default role could discover and invoke other agents, read and alter memories, pull ECR images, and retrieve secrets with GetResourceApiKey and secretsmanager:GetSecretValue. AWS called metadata access expected, then required IMDSv2 for new agents from February 14, 2026, and later removed broad cross-agent and Secrets Manager permissions.

GBHackersOct 10, 06:59 UTC · 6d agoAI safety & security 2 sources8· 3 reads

One Prompt Could Hijack AWS AI Agents and Steal Cloud Credentials

Zenity's AgentCorruption chain let one prompt expose Bedrock AgentCore chats, memories, and cloud secrets.

Zenity Labs reported AgentCorruption: a public Amazon Bedrock AgentCore agent with a web or shell tool could be prompt-injected into calling 169.254.169.254 inside its Firecracker microVM. The returned execution-role credentials could expose private chats, source code, long-term memories, API keys, OAuth tokens, and Secrets Manager values, and invoke other agents in the same account and region. Zenity reported metadata access on December 25, 2025, and broad role permissions on January 12, 2026. AWS required IMDSv2 and by September 29, 2026 had removed broad invocation, chat, and Secrets Manager permissions, while saying metadata access is documented behavior rather than a vulnerability.

Cyber Security NewsOct 10, 06:58 UTC · 6d agoAI safety & security 2 sources5· 2 reads

AWS AgentCore security undone by prompt requesting credentials

Zenity Labs showed one prompt could steal AWS AgentCore IMDS credentials and hijack regional agents.

Zenity Labs reported that Amazon Bedrock AgentCore agents could reach the instance metadata service because Firecracker network isolation was insufficient. A user with only chat access could prompt an agent into an SSRF that returned temporary IMDSv1 credentials for an overprivileged IAM role covering all AgentCore resources in the account and region. Those credentials could enumerate agents, pull ECR images, read and rewrite agent memories and sessions, and access AWS Secrets Manager. AWS told researchers the finding was informative, enforced IMDSv2 on February 14, 2026, and had remediated the remaining permission issues by Zenity's September 29, 2026 review.

The Register · SecurityOct 9, 19:15 UTC · 7d agoAI safety & security8· 3 reads

Amazon Elastic Container Registry

Timeline3 articles

Appears with

AWS Bedrock AgentCore Flaw Allowed Attackers to Hijack AI Agents Using a Single Prompt

One Prompt Could Hijack AWS AI Agents and Steal Cloud Credentials

AWS AgentCore security undone by prompt requesting credentials