Zenity finds chain of flaws letting one prompt hijack all AWS Bedrock AgentCore agents in a region
Security researchers at Zenity Labs reported a chain of vulnerabilities they call 'AgentCorruption' in Amazon's Bedrock AgentCore that let a single chat prompt to a publicly reachable agent expose instance metadata and temporary credentials, then pivot to take over every AgentCore agent in the same AWS account and region. AWS has partially mitigated the issue by making IMDSv2 the default for new AgentCore deployments and tightening the default execution role, and Zenity recommends manually scoping agent roles to minimal permissions.