{
 "id": "TR-2026-023",
 "status": "published",
 "title": "'AgentCorruption' Puts AWS Environments at Risk With Single Prompt",
 "date": "2026-10-08",
 "window": null,
 "ai_role": "target",
 "category": "red_team",
 "summary": "Zenity Labs researchers said they sent a plain-language prompt to one exposed Amazon Bedrock AgentCore agent, which fetched its execution role credentials from the instance metadata service. They then used the credentials from their own computer. According to Zenity, the broad default role let them list agents, copy container images and source code, invoke internal agents, read private conversations, retrieve stored secrets, and plant persistent memory instructions. AWS disputed the characterization, calling it documented behavior rather than a vulnerability.",
 "attacker": {
  "description": "Zenity Labs researchers, who used a prompt sent to an exposed agent"
 },
 "defender": {
  "description": "Amazon Web Services (Amazon Bedrock AgentCore agents within one AWS account and region)"
 },
 "scale": "All AgentCore agents in a single AWS account and region (per Zenity); no victim counts given",
 "impact": "Per Zenity, the researchers could read private conversations, copy agent source code, steal stored credentials including third-party service keys, and plant memories that persistently altered agent behavior. The article describes a research demonstration, not exploitation of real customers.",
 "tactics": [
  "TA0001",
  "TA0003",
  "TA0004",
  "TA0006",
  "TA0007",
  "TA0008",
  "TA0009"
 ],
 "timeline": [
  {
   "date": "2025-12-25",
   "text": "Zenity reported the metadata access issue to AWS.",
   "tier": null,
   "source": "1"
  },
  {
   "date": "2026-01-12",
   "text": "Zenity reported the broad default role to AWS.",
   "tier": null,
   "source": "1"
  },
  {
   "date": "2026-02-14",
   "text": "Per AWS, newly deployed AgentCore agents began launching with IMDSv2 only.",
   "tier": null,
   "source": "1"
  },
  {
   "date": "2026-04",
   "text": "AWS closed the first report as 'informative', according to Zenity.",
   "tier": null,
   "source": "1"
  },
  {
   "date": "2026-06",
   "text": "Zenity said the default role was still unchanged.",
   "tier": null,
   "source": "1"
  },
  {
   "date": "2026-09-29",
   "text": "In a final check before publication, Zenity found AWS had narrowed the default role.",
   "tier": null,
   "source": "1"
  },
  {
   "date": "2026-10-08",
   "text": "Zenity published the research alongside a SecTor 2026 talk; AWS issued a statement disputing it.",
   "tier": null,
   "source": "1"
  }
 ],
 "lessons": [],
 "models_named": [
  {
   "name": "Amazon Bedrock AgentCore",
   "role": "target"
  }
 ],
 "related_agents": [],
 "vendor_response": "AWS said the behavior was documented and not a vulnerability, and recommended granting execution roles only the permissions agents need. Per Zenity, AWS said new AgentCore agents have launched with IMDSv2 only since 14 February, and Zenity found on 29 September that the default role had been narrowed (invoke, read conversations and Secrets Manager permissions removed).",
 "sources": [
  {
   "title": "'AgentCorruption' Puts AWS Environments at Risk With Single Prompt",
   "url": "https://www.darkreading.com/cloud-security/agentcorruption-aws-environments-at-risk-single-prompt",
   "outlet": "Dark Reading",
   "date": "2026-10-08"
  },
  {
   "title": "One prompt let researchers take over every AWS AgentCore agent in a region",
   "url": "https://thenextweb.com/news/aws-agentcore-zenity-agentcorruption-one-prompt-agents",
   "outlet": "The Next Web",
   "date": "2026-10-08"
  },
  {
   "title": "AgentCorruption: how a single prompt collapsed the entire cloud security model",
   "url": "https://labs.zenity.io/post/agentcorruption-how-a-single-prompt-collapsed-the-entire-cloud-security-model",
   "outlet": "Zenity Labs",
   "date": "2026-10-08"
  }
 ],
 "reviewer": "model: claude-sonnet-5-5 (automated review)",
 "checked_on": "2026-10-25"
}