Zenity AgentCorruption reports describe AWS Bedrock AgentCore risk
These six reports restate the AgentCorruption account already in the prior summary and do not cover its separate six-framework study. Disagreements remain on an August 2026 versus September 29, 2026 permission change and on whether metadata access is a vulnerability.
Zenity says one prompt could steal Bedrock AgentCore credentials and reach other regional agents; AWS later tightened defaults but disputes the vulnerability label.
Zenity Labs reported an AgentCorruption chain in Amazon Bedrock AgentCore in which one prompt to a public agent with a web, HTTP, or shell tool could reach the instance metadata service inside its Firecracker microVM and return temporary execution-role credentials. Researchers said the STS keys worked outside the sandbox and, with default permissions, covered agents in the same account and region, exposing images, private chats, memories, secrets, and other agents. Dark Reading says the issue is patched, names no CVE, and reports no confirmed exploitation. Sources disagree on timing: The Register and GBHackers say IMDSv2 was required from February 14, 2026, and The Register and Cyber Security News say broad permissions were removed by September 29, 2026, while The Decoder places the role change around August 2026. AWS treated metadata access as expected or informative rather than a vulnerability. CSO Online also describes a September 2026 Unit 42 finding that default Harness settings let a root shell leak AgentCore Identity credentials, closed by AWS as informative, and says some fixes closed one path while others remained.
- Zenity Labs reported an AgentCorruption chain: one prompt to a public Amazon Bedrock AgentCore agent with a web, HTTP, or shell tool could read temporary IMDSv1/STS execution-role credentials from the Firecracker microVM metadata service.
- Researchers said those credentials worked outside AgentCore through AWS APIs and, under the default role, covered AgentCore resources in the same account and region.
- Described access included ECR image pulls, private chats and memories, other agents, and secrets via Secrets Manager, GetResourceApiKey, and secretsmanager:GetSecretValue, plus read, write, and delete actions.
- Zenity reported metadata access on December 25, 2025; Cyber Security News also cites a January 12, 2026 report on broad role permissions.
- The Register and GBHackers say AWS required IMDSv2 from February 14, 2026, while The Decoder says IMDSv2 later became the default for new deployments without giving that date.
- Role narrowing is placed around August 2026 by The Decoder and by a September 29, 2026 review by The Register and Cyber Security News; CSO Online says Zenity called its specific path fixed as of October 8, 2026.
- AWS called metadata access expected, documented, or informative rather than a vulnerability; Dark Reading reports no CVE and no confirmed in-the-wild exploitation.
- CSO Online separately cites Unit 42's September 2026 report that default Harness settings and a root shell could leak plaintext AgentCore Identity credentials, which AWS closed as informative, plus an earlier metadata flaw lacking…
Coverage
oldest first · one row per article · UTC- · 22d ago
The DecoderFirst report
A single prompt was enough to hijack every AI agent in an AWS account, Zenity researchers found
Zenity says one prompt against a public Bedrock AgentCore agent could hijack every agent in that AWS region.
- · 22d ago
CSO Online
AWS’s repeated problems with AI agent controls illustrates the autonomous agent dilemma
Unit 42 and Zenity say AWS AgentCore defaults let prompt injection steal credentials and move across agents.