AWS Bedrock AgentCore 2026 Review: One Prompt Hijacks Every Agent
Category: Tech Deep Dives
This analysis was written by the aifreetool Editorial Team — a group of full-time AI-industry researchers and writers who verify every claim against primary sources. Last updated October 12, 2026. We keep no affiliate relationship with the companies covered here.
TL;DR: Zenity Labs disclosed AgentCorruption, a flaw in AWS Bedrock AgentCore that lets a single prompt force one agent to query the instance metadata service, steal temporary AWS credentials, and pivot to every other agent in the same account and region. AWS reportedly called the access pattern expected behavior, then shipped mitigations anyway: IMDSv2 became the default in February 2026, and broad cross-agent permissions were reduced on September 29, 2026.
The Exploit Chain
Zenity Labs researchers Tamir Ishay Sharbat and Lana Salameh presented the attack at SecTor 2026 in Toronto. The chain starts with prompt injection against a public-facing Bedrock AgentCore agent. Because the underlying Firecracker microVM did not block access to the instance metadata service, the agent could reach 169.254.169.254 and retrieve temporary AWS credentials.
This is a server-side request forgery path, not a traditional code vulnerability. The researchers did not need to exploit a bug in the chat page. They simply instructed the agent to connect to the local metadata endpoint, and the agent followed the instruction. The real damage came from the default execution role, which was scoped to the entire AWS account and region rather than to the single agent.
With those credentials, an attacker could invoke any other agent in the region, read private conversations, pull container images from Amazon Elastic Container Registry to expose source code, and retrieve secrets from AWS Secrets Manager. They could also create false memories using the BedrockAgentCoreMemory CreateEvent function, effectively implanting persistent instructions that survive across user sessions.
Why AWS Called It Expected Behavior
When Zenity reported the issue on December 25, 2025, AWS characterized the metadata access as documented behavior. The company said agents can access credentials for their own execution role through the metadata service. That framing is technically accurate: IMDSv1 has always returned credentials to any code running inside the instance.
The gap is between what is documented and what customers expect. A business deploying a managed AI agent service typically assumes the agent is sandboxed to its own resources. AWS eventually shipped hardening. IMDSv2 became the default for new deployments on February 14, 2026. On September 29, 2026, AWS removed broad cross-agent invocation, conversation reading, and Secrets Manager access from the default execution role.
The nine-month window between disclosure and the final permission reduction left early deployments exposed. No CVE was issued, and Zenity found no evidence of in-the-wild exploitation, but the configuration risk was present for any account using the default role.
What the Attack Means for AI Agent Security
AgentCorruption is an infrastructure-level problem, not a model-level problem. That distinction matters. CoreBreak, an earlier issue covered by security researchers, bypassed model guardrails through the InvokeHarness API. AgentCorruption bypasses isolation between agents through identity and access management.
| Layer | Issue | Fix |
|---|---|---|
| Model logic | Jailbreak, policy bypass | Stronger classifiers, monitoring |
| Agent runtime | InvokeHarness abuse | API hardening, harness isolation |
| Cloud IAM | Overprivileged default role | Least-privilege roles, IMDSv2 |
The lesson is that AI agents must be treated like cloud workloads. That means least-privilege IAM roles, network segmentation for metadata endpoints, and regular review of permissions after every agent deployment or service update.
What Security Teams Should Do Now
AWS recommends several concrete steps: craft custom execution roles with minimal permissions, avoid wildcard permissions, validate prompt input, limit network access to the metadata service, and monitor for unusual agent activity. Organizations using Bedrock AgentCore should audit existing roles, especially if deployments predate the September 29 permission changes.
If your team is evaluating AI agent platforms, read our Tech Deep Dives for architecture analysis, or check AI Coding tools that are integrating agent runtimes.
My Take / The Bottom Line
AWS is not wrong that metadata access is documented behavior. The problem is that default Bedrock AgentCore roles were far broader than any reasonable deployment needs. Calling it expected behavior while simultaneously hardening the defaults sends a mixed signal: either the configuration was unsafe, or the mitigation was unnecessary.
My view: treat every AI agent as a full cloud workload with its own identity, network posture, and audit trail. Do not rely on managed-agent defaults. The AgentCorruption disclosure is useful because it forces security teams to apply cloud-security fundamentals to a new layer of abstraction. The businesses that move fastest on IAM reviews will be the ones safest when agent traffic scales.
Frequently Asked Questions
Q: What is AgentCorruption in AWS Bedrock AgentCore?
A: It is a disclosed attack chain in which a single prompt to a public Bedrock AgentCore agent can steal temporary AWS credentials and pivot to every other agent in the same account and region.
Q: Did AWS fix the Bedrock AgentCore vulnerability?
A: AWS made IMDSv2 the default in February 2026 and reduced broad default permissions on September 29, 2026. Customers should still audit custom and older deployments.
Q: What data could an attacker access through AgentCorruption?
A: Stolen credentials allowed access to other agents, private conversations, ECR container images, AWS Secrets Manager secrets, and the ability to implant persistent false memories.
Q: Is this a software bug or a configuration issue?
A: It is primarily an infrastructure and IAM configuration issue. The metadata access was documented behavior, but the default role was overprivileged for typical agent isolation expectations.
Q: How can teams protect their Bedrock AgentCore deployments?
A: Use custom least-privilege roles, enforce IMDSv2, block metadata access where possible, validate prompts, and monitor agent activity for credential misuse or lateral movement.
