One prompt hijacked every AgentCore agent in an AWS account, Zenity says
Security firm Zenity Labs published research on a vulnerability chain it calls "AgentCorruption": chat access to a single public Amazon Bedrock AgentCore agent was enough to trick it, in plain language, into querying the instance metadata service at 169.254.169.254 and sending its own temporary AWS credentials to an external server. Using AgentCore's overly broad default execution role, the researchers then listed and invoked every agent in the same account and region, downloaded their source code and container images, read private user-agent conversations and secrets from AWS Secrets Manager, and poisoned long-term memory to make the hijack persistent. Zenity says it reported the findings to AWS on 25 December 2025; AWS has since made IMDSv2 the default for new AgentCore deployments and narrowed the default role.
It shows that default permissions on managed agent platforms can turn one entry point into a region-wide breach, making least-privilege custom roles essential.
Researchers at Zenity Labs say a single publicly accessible AI agent on Amazon's Bedrock AgentCore was enough to take over every AgentCore agent in the same AWS account and region.
Amazon Bedrock AgentCore is AWS' platform for running enterprise AI agents with tools, memory, and access management. Security firm Zenity Labs found a chain of vulnerabilities that the researchers call "AgentCorruption."
An attacker needed only chat access to one public agent to exploit the flaws. The researchers say a single prompt let them take over every AgentCore agent in the same AWS account and region, exposing private conversations, source code, and stored credentials. According to Zenity, the problem was systemic and affected agents with built-in tools in multiple AWS accounts.
The agent handed over its own credentials
AWS runs an Instance Metadata Service at the internal address 169.254.169.254 that provides temporary credentials for instances and workloads to authenticate with AWS. Anyone who captures those credentials can use them to impersonate the instance.
An AI agent normally shouldn't be able to reach that service, but AgentCore lacked proper isolation, according to Zenity's technical blog post. The researchers built a test agent using Strands, an open-source framework from AWS that ships with a web tool. When asked in plain language to query the metadata service and send the results to an external server, the agent followed the instructions. "The sandbox boundary we were supposed to be fighting simply wasn't there," the researchers write.
#Zenity Labs#Amazon Web Services#Amazon Bedrock AgentCore#Amazon Bedrock#Strands#AWS Secrets Manager#Sony#Ericsson