Zenity discloses patched AWS Bedrock AgentCore vulnerabilities: a single prompt can take over all agents in the same account and region

Zenity Labs Director of Security Research Tamir Ishay Sharbat disclosed at SecTor 2026 a fixed flaw in AWS Bedrock AgentCore, named AgentCorruption. By sending a single prompt to a public-facing chatbot, an Agent deployed via AgentCore can access the instance metadata service IMDS, obtain sensitive data such as temporary credentials, instance ID, and configuration, and further control all Agents in the same AWS account and region. Zenity reported the IMDS flaw to AWS in December last year, then supplemented reports on default role over-privilege and impact scope; AWS updated AgentCore in February this year, making newly deployed Agents use authenticated IMDSv2, and adjusted the default role, removing permissions to invoke other Agents, read private conversations, and access Secrets Manager.