Zenity discloses AWS Bedrock AgentCore vulnerability chain: a single public agent can take over agents in the same account and region
One public-facing AI agent on AWS could read, rewrite, and delete every other agent in the region
Security company Zenity Labs says that on AWS's Bedrock AgentCore platform, with only chat access to a public Agent, a single prompt can take over all AgentCore Agents in the same AWS account and region, reading private conversations, source code, and stored credentials. The researchers call this vulnerability chain AgentCorruption, and the problem lies in the platform itself: AgentCore lacks isolation, Agents can access the instance metadata service at internal address 169.254.169.254 and hand over their own temporary AWS credentials, which are also usable outside the platform; even if the web tool is removed, the attack can be completed via command-line tools.
披露了 AWS Bedrock AgentCore 默认权限过宽导致的跨 Agent 接管链，部署多 Agent 的团队可据此检查默认角色与元数据服务隔离。