Zenity discloses AWS Bedrock AgentCore vulnerability chain
Start here
Security company Zenity Labs discloses a vulnerability chain in the AWS Bedrock AgentCore platform, named AgentCorruption. The researchers say that with only chat access to a public Agent, a single prompt can make an Agent deployed via AgentCore access the instance metadata service (IMDS) at internal address 169.254.169.254, thereby obtaining sensitive data such as execution role temporary credentials, instance ID, and configuration, and further take over all AgentCore Agents in the same AWS account and region, reading private conversations, source code, and stored credentials. Zenity Labs Director of Security Research Tamir Ishay Sharbat disclosed this fixed flaw at SecTor 2026.
Generated by AI from reports · Updated 3 days ago
Progress timeline
- Dark ReadingSelectedZenity discloses patched AWS Bedrock AgentCore vulnerabilities: a single prompt can take over all agents in the same account and region
Zenity Labs Director of Security Research Tamir Ishay Sharbat disclosed at SecTor 2026 a fixed flaw in AWS Bedrock AgentCore, named AgentCorruption. By sending a single prompt to a public-facing chatbot, an Agent deployed via AgentCore can access the instance metadata service IMDS, obtain sensitive data such as temporary credentials, instance ID, and configuration, and further control all Agents in the same AWS account and region. Zenity reported the IMDS flaw to AWS in December last year, then supplemented reports on default role over-privilege and impact scope; AWS updated AgentCore in February this year, making newly deployed Agents use authenticated IMDSv2, and adjusted the default role, removing permissions to invoke other Agents, read private conversations, and access Secrets Manager.
- X @mbrg0Zenity Labs discloses an attack against AWS Bedrock AgentCore: a single prompt steals execution role credentials
Zenity Labs says a single prompt can compromise an exposed AWS Bedrock AgentCore Agent because IMDS is not shielded inside the microVM; one HTTP request stole execution role credentials. Author Michael Bargury retweeted and called it a particularly tricky case. The research points the attack surface to metadata service access control in cloud agent runtime environments; the specific affected configuration scope and fix status are not stated in the material.
- The DecoderSelectedZenity discloses AWS Bedrock AgentCore vulnerability chain: a single public agent can take over agents in the same account and region
Security company Zenity Labs says that on AWS's Bedrock AgentCore platform, with only chat access to a public Agent, a single prompt can take over all AgentCore Agents in the same AWS account and region, reading private conversations, source code, and stored credentials. The researchers call this vulnerability chain AgentCorruption, and the problem lies in the platform itself: AgentCore lacks isolation, Agents can access the instance metadata service at internal address 169.254.169.254 and hand over their own temporary AWS credentials, which are also usable outside the platform; even if the web tool is removed, the attack can be completed via command-line tools.
Related discussion
- Older than 72 hours · Not included in the 72-hour figures
- XX @zenitysec_labsNew research: one prompt to one exposed AWS Bedrock AgentCore agent collapsed the entire cloud security model.(opens the original post in a new tab)
Attention trend
New sources per day
- Oct 8New3 sources (2 outlets,1 accounts)
- Oct 9New1 sources (1 outlets,0 accounts)
- Oct 10New0 sources (0 outlets,0 accounts)
- Oct 11New0 sources (0 outlets,0 accounts)
- Oct 12New0 sources (0 outlets,0 accounts)
- Oct 13New0 sources (0 outlets,0 accounts)