AWS AgentCore flaws let one prompt expose agents across an account
Zenity Labs researchers say a single prompt to a public-facing Amazon Bedrock AgentCore agent could expose temporary AWS credentials, letting them access other agents in the same account and region. The researchers reported that weak access to the metadata service and an overbroad default role enabled access to private conversations, container images, secrets and persistent changes to agents’ behaviour.
Bottom line — AWS switched AgentCore to IMDSv2 in February 2026 and addressed the broader permission gap by late September, according to Zenity Labs.
Go deeper 6
-
Zenity said its researchers reported the metadata exposure to AWS in December 2025 and the excessive permissions in January 2026.
-
The Register reported that AWS closed the initial report as “informative” on April 12, 2026, citing the February move to IMDSv2.
-
Zenity found the overbroad permissions remained in place when it checked on June 22, 2026; a review on September 29 found the remaining issues addressed.
-
The researchers said stolen credentials could be used to read agent sessions, retrieve container images and access secrets stored in AWS Secrets Manager.
-
Zenity said researchers also created memories across agents and users, which could persistently steer behaviour in later sessions.
-
Amazon told The Register after publication that Zenity’s research misrepresented documented behaviour as a vulnerability and suggested developer error would be needed for the attack.