AWS AgentCore agents gave up credentials to a single prompt

Researchers at Zenity Labs found that AI agents deployed on Amazon Bedrock AgentCore could be talked into handing over their cloud credentials with a single chat message, according to a report published by The Register on 9 October 2026. The flaw, disclosed to Amazon Web Services in December 2025, meant an external attacker with nothing more than chat access to one exposed agent could take over every AgentCore agent in the same AWS account and region.

The attack worked by asking the agent to fetch and summarise a URL. That URL pointed at the Instance Metadata Service, or IMDS, the internal endpoint that cloud instances use to look up information about themselves. According to the Zenity researchers Tamir Ishay Sharbat and Lana Salameh, agents running on AgentCore could reach their own IMDS endpoint, because the Firecracker MicroVM used to isolate them did not provide sufficient network separation. The agent dutifully returned the raw JSON, which included the temporary AWS credentials issued to the workload's IAM role. This is a server-side request forgery, where an attacker makes a server fetch an internal resource on their behalf.

The Register reports that at the time AgentCore still used IMDSv1, the older version of the metadata service that lacks protections added in IMDSv2.

What made the credential theft serious was what the credentials unlocked. The researchers said the default AgentCore IAM role was scoped to all AgentCore resources in the region rather than to a single agent. Anyone holding the temporary credentials could enumerate the organisation's other agents, log in to Amazon Elastic Container Registry, pull the agent container images and run them as root to read the source code. They could also list memory resources in the region and extract users and their agent sessions, meaning the conversations people had held with those agents.

The credentials also allowed writing, not just reading. "By leveraging the IMDS credentials we could send direct API requests to create new memories across different agents and users," Sharbat and Salameh said in their blog post. "These in turn would persistently alter agent behaviour and hijack the agents' goals across future sessions." The same credentials could fetch secrets from AWS Secrets Manager.

The disclosure timeline ran for most of a year. Zenity reported the IMDS issue in December 2025 and followed up in January 2026 with details about AgentCore being overprivileged. On 12 April 2026, AWS told the researchers the report was "informative" and closed it, noting that as of 14 February 2026 AgentCore used IMDSv2 exclusively. Zenity checked again on 22 June 2026 and found the excessive permissions had not been remediated. A final review on 29 September 2026 found AWS had addressed the outstanding problems, which is why the research could be published.

After The Register published, Amazon said Zenity's research misrepresents documented behaviour as a vulnerability, and suggested developer error would be required to enable the attack. The Register said it has asked Amazon for clarification, because that is not the scenario Zenity described.

The case is a reminder that an agent with a web-fetch tool is a network client inside your cloud account, and that the identity it runs under should be scoped to that one agent rather than to everything around it.