AWS AgentCore security undone by prompt requesting credentials
Zenity Labs showed one prompt could steal AWS AgentCore IMDS credentials and hijack regional agents.
Zenity Labs reported that Amazon Bedrock AgentCore agents could reach the instance metadata service because Firecracker network isolation was insufficient. A user with only chat access could prompt an agent into an SSRF that returned temporary IMDSv1 credentials for an overprivileged IAM role covering all AgentCore resources in the account and region. Those credentials could enumerate agents, pull ECR images, read and rewrite agent memories and sessions, and access AWS Secrets Manager. AWS told researchers the finding was informative, enforced IMDSv2 on February 14, 2026, and had remediated the remaining permission issues by Zenity's September 29, 2026 review.