NEWS · COMPANIES · #1713
Zenity finds chain of flaws letting one prompt hijack all AWS Bedrock AgentCore agents in a region
Security researchers at Zenity Labs reported a chain of vulnerabilities they call 'AgentCorruption' in Amazon's Bedrock AgentCore that let a single chat prompt to a publicly reachable agent expose instance metadata and temporary credentials, then pivot to take over every AgentCore agent in the same AWS account and region. AWS has partially mitigated the issue by making IMDSv2 the default for new AgentCore deployments and tightening the default execution role, and Zenity recommends manually scoping agent roles to minimal permissions.
KEY POINTS
- Security researchers at Zenity Labs reported a chain of vulnerabilities they call 'AgentCorruption' in Amazon's Bedrock AgentCore that let a single chat prompt to a publicly reachable agent expose instance metadata and temporary credentials, then pivot to take over every AgentCore agent in the same AWS account and region.
- AWS has partially mitigated the issue by making IMDSv2 the default for new AgentCore deployments and tightening the default execution role, and Zenity recommends manually scoping agent roles to minimal permissions.
- The flaw shows AI agents can expose cloud credentials and propagate privileges across an account, creating a high‑impact, hard‑to-detect attack path for enterprise AI deployments.
WHY IT MATTERS
The flaw shows AI agents can expose cloud credentials and propagate privileges across an account, creating a high‑impact, hard‑to-detect attack path for enterprise AI deployments.