Zenity Reports Bedrock AgentCore Prompt Exposed Cloud Credentials

Zenity said one Bedrock AgentCore prompt could yield execution-role credentials and reach chats, secrets, and other agents; AWS disputes it was a vulnerability.

Zenity Labs reported AgentCorruption, a chain in which a single prompt directed a public Amazon Bedrock AgentCore agent with a web, HTTP, or shell tool to query the metadata service at 169.254.169.254 inside its Firecracker microVM. The service returned temporary execution-role credentials that could be exported and used directly through AWS APIs. Zenity said the default role could expose private chats, source code, long-term memories, API keys, OAuth tokens, and Secrets Manager values, and could discover or invoke other agents in the same account and region through actions including DescribeLogGroups, InvokeAgentRuntime, ListEvents, CreateEvent, ECR image pulls, GetResourceApiKey, and secretsmanager:GetSecretValue. Zenity reported metadata access on December 25, 2025, and overly broad role permissions on January 12, 2026. AWS required IMDSv2, including for new agents from February 14, 2026, and by September 29, 2026 had removed broad invocation, chat, and Secrets Manager permissions. Zenity says the issues are fixed, while AWS disputes the vulnerability label and calls metadata access documented behavior.

• Zenity Labs disclosed AgentCorruption against public Amazon Bedrock AgentCore agents that had a web, HTTP, or shell tool; no separate chat bug was required.
• One prompt could make the agent query the Firecracker microVM metadata service at 169.254.169.254 and return temporary execution-role credentials, which researchers reused through AWS APIs.
• Those credentials could expose private chats, source code, long-term memories, API keys, OAuth tokens, and Secrets Manager values, and reach other agents in the same account and region.
• Cited permissions and actions included DescribeLogGroups, InvokeAgentRuntime, ListEvents, CreateEvent, ECR image pulls, GetResourceApiKey, and secretsmanager:GetSecretValue.
• Zenity reported metadata access on December 25, 2025, and broad role permissions on January 12, 2026.
• AWS required IMDSv2, including for new agents from February 14, 2026, and by September 29, 2026 had removed broad invocation, chat, and Secrets Manager permissions.
• Zenity says the issues are fixed; AWS says metadata access is documented behavior rather than a vulnerability.