'AgentCorruption' flaw in AWS Bedrock AgentCore now patched

A now-patched vulnerability in AWS Bedrock AgentCore, the Amazon Web Services service for running AI agents, could have allowed an attacker to use a single AI chatbot to take over an organisation's entire agent fleet, according to a report published by Dark Reading on 8 October 2026.

The flaw has been named "AgentCorruption". Dark Reading reports that the issue has been fixed, so there is no action described for customers beyond the patch already applied by the vendor. The report does not describe any known exploitation in the wild, and no affected organisations are named.

The attack route described is prompt injection, in which text supplied to a language model is treated by that model as an instruction rather than as data to be processed. In the AgentCorruption case, the reported consequence of one such prompt against one chatbot was not limited to that chatbot: it extended to the wider fleet of agents running in the same AWS environment. That is the detail that makes the finding notable. Most prompt injection results in a single agent misbehaving. A fleet-wide outcome means the blast radius of one compromised conversation is the whole deployment.

AgentCorruption fits a pattern that has become familiar to teams running agentic systems. Agents are given credentials and permissions so they can act on a user's behalf, and those permissions are often shared across a managed service. When an attacker can steer one agent's behaviour through untrusted input, the question becomes what that agent is allowed to reach. Dark Reading's account indicates the answer, in this case, was a great deal.

The source material available at the time of writing is brief. It does not set out the technical mechanism of the escalation, the researchers or firm credited with the discovery, the date AWS was notified, the date the fix shipped, or whether a CVE identifier has been assigned. It also does not state whether customer data was at risk in any specific deployment. Readers should treat the severity framing as the publication's, not as a vendor-assigned score.

For organisations running agents on managed cloud platforms, the practical takeaway from a disclosure of this shape is unchanged: assume that any text an agent reads may carry instructions, and scope each agent's permissions so that one compromised agent cannot speak for the rest. The Agentic Times has not independently verified the report and will update this article if AWS publishes a security bulletin with further detail.