AgentCorruption: one prompt reached every AWS AgentCore agent

Zenity Labs published AgentCorruption on October 8: a chain of issues in Amazon Bedrock AgentCore where one prompt to one public-facing agent gave researchers control of every AgentCore agent in the same AWS account and region. No exploit kit. A chat message. If you run AI agents on AgentCore, or on any cloud runtime, the lesson is about the role your agent runs as, not the model.

What actually happened

Per Zenity's disclosure, presented at SecTor 2026 in Toronto, the researchers asked an internet-facing agent with a standard web-request tool to query the AWS Instance Metadata Service (IMDS). The agent's runtime let it reach IMDS and hand back temporary credentials for its execution role.

That default role was the problem. Its permissions covered all AgentCore agents in the account and region, not only the one agent. With it, Zenity says it could list and invoke internal agents, download container images and source code, read private conversations and long-term memories, and pull API keys and OAuth tokens from AWS Secrets Manager. It also planted malicious memories that sent future conversations to an attacker-controlled destination. Zenity's example: a customer service bot used as a door into an internal finance agent.

Zenity reported the issue to AWS on December 25, 2025. The Next Web reports that newly deployed agents have launched with IMDSv2 only since February 14, and that by September 29 AWS had removed the default role's ability to invoke other agents, read conversations and reach Secrets Manager. AWS disputes the framing. It told TNW the research "inaccurately paints expected and documented behavior as a vulnerability," and says customers should grant execution roles only the permissions each agent needs. There is no CVE.

Why AgentCore agent roles matter for your business

Your agent is as dangerous as its role. Prompt injection will get through eventually. What decides the damage is what the credentials behind the agent can touch. A public chatbot should not hold a key that opens your finance agent.

Defaults changed for new agents, not your old ones. The IMDSv2 change applies to newly deployed agents. If you shipped an AgentCore agent before mid-February, or copied an old role template, check it yourself.

Split public and internal agents. Separate execution roles at minimum. Separate AWS accounts if the internal agent touches money or customer records. Treat memory as an attack surface and review what gets written to it.

Sources: Zenity Labs, The Next Web.