'AgentCorruption' Puts AWS Environments at Risk With Single Prompt

Zenity Labs researchers said they sent a plain-language prompt to one exposed Amazon Bedrock AgentCore agent, which fetched its execution role credentials from the instance metadata service. They then used the credentials from their own computer. According to Zenity, the broad default role let them list agents, copy container images and source code, invoke internal agents, read private conversations, retrieve stored secrets, and plant persistent memory instructions. AWS disputed the characterization, calling it documented behavior rather than a vulnerability.

Export STIX 2.1 Export JSON Request a correction (GitHub issue)

Timeline

2025-12-25 Zenity reported the metadata access issue to AWS. · Dark Reading

2026-01-12 Zenity reported the broad default role to AWS. · Dark Reading

2026-02-14 Per AWS, newly deployed AgentCore agents began launching with IMDSv2 only. · Dark Reading

2026-04 AWS closed the first report as 'informative', according to Zenity. · Dark Reading

2026-06 Zenity said the default role was still unchanged. · Dark Reading

2026-09-29 In a final check before publication, Zenity found AWS had narrowed the default role. · Dark Reading

2026-10-08 Zenity published the research alongside a SecTor 2026 talk; AWS issued a statement disputing it. · Dark Reading

Sources · 3

'AgentCorruption' Puts AWS Environments at Risk With Single Prompt — Dark Reading, 2026-10-08 ○ On 2026-10-26, this link could not be verified (bot wall).
One prompt let researchers take over every AWS AgentCore agent in a region — The Next Web, 2026-10-08 ⚠ On 2026-10-26, this link no longer there (404).
AgentCorruption: how a single prompt collapsed the entire cloud security model — Zenity Labs, 2026-10-08

Links re-checked 2026-10-26 by the weekly refresh. A link that moved or stopped answering is flagged above; it is not a change to the record.

At a glance · as reported

Window	2026-10-08
Attacker	Zenity Labs researchers, who used a prompt sent to an exposed agent
Scale	All AgentCore agents in a single AWS account and region (per Zenity); no victim counts given
Impact	Per Zenity, the researchers could read private conversations, copy agent source code, steal stored credentials including third-party service keys, and plant memories that persistently altered agent behavior. The article describes a research demonstration, not exploitation of real customers.
Defender	Amazon Web Services (Amazon Bedrock AgentCore agents within one AWS account and region)
Response	AWS said the behavior was documented and not a vulnerability, and recommended granting execution roles only the permissions agents need. Per Zenity, AWS said new AgentCore agents have launched with IMDSv2 only since 14 February, and Zenity found on 29 September that the default role had been narrowed (invoke, read conversations and Secrets Manager permissions removed).

Tactics (MITRE ATT&CK)

TA0001 Initial Access
TA0003 Persistence
TA0004 Privilege Escalation
TA0006 Credential Access
TA0007 Discovery
TA0008 Lateral Movement
TA0009 Collection

Mapped by the maintainer from the reports.

Models and agents named

Amazon Bedrock AgentCore — target

Published by the weekly machine review (claude-sonnet-5-5 (automated review)) from the sources above on 2026-10-25: every field is as the sources state it, or empty. Compiled from the public sources above, as reported. Not an attribution, a finding of fault or a legal conclusion; figures are those stated by the sources. One event, as of its sources' dates.