AgentCorruption Lets One Prompt Seize a Bedrock AgentCore Fleet

Key Takeaways

• Zenity Labs presented AgentCorruption at SecTor 2026 on October 7 and published it October 8.
• A prompt asked a public agent to fetch its own cloud credentials from the metadata service.
• The default role let those credentials invoke other agents, read conversations, and retrieve stored secrets.
• AWS changed defaults but disputes calling it a vulnerability; no exploitation has been reported.

From One Chatbot to a Whole Agent Fleet

Zenity Labs showed that one prompt to a public Amazon Bedrock AgentCore agent could expose its cloud credentials. Dark Reading reported that the platform's default permissions then reached every agent in the same account and region.

What We Know

Zenity presented the research at SecTor 2026 in Toronto on October 7, 2026, and published it the next day. It says it reported the findings to AWS in late December 2025.

According to Let's Data Science, AWS made IMDSv2 the default for new agents from February 14, 2026, and later narrowed the default role.

AWS disputes calling the behavior a vulnerability. It says access to an agent's own credentials is expected, and that customers must scope roles with least privilege. No exploitation has been reported.

What Could Happen

The chain began with a common capability: an HTTP request tool. Researchers asked their agent, in plain language, to fetch its instance metadata endpoint, and it returned the temporary credentials of its execution role.

Those credentials worked outside the sandbox. The default role reached every AgentCore resource in the account and region.

Zenity reports it could then invoke other agents, read their stored conversations, plant memories, and retrieve secrets. Prompt injection opened the door, but excessive privilege set the blast radius.

Why It Matters

Agents built for customers are exposed to untrusted input by design. When their identity reaches far beyond their job, one conversation becomes a credential theft path.

Here that path led to private conversations and stored secrets, a serious privacy and regulatory exposure.

The dispute with AWS shows that platform defaults cannot be assumed safe for public agents. The NIST AI RMF and the OWASP Top 10 for Agentic Applications both point to least privilege for every agent.

PointGuard AI Perspective

AgentCorruption shows that an agent's blast radius is set by its identity, not its prompt. PointGuard AI addresses both.

With Agent Identity and Access Security, every agent gets its own cryptographic identity. Intent-based access control works at the per-agent, per-tool, and per-operation level, so a support agent cannot quietly invoke other agents.

Pre-execution validation checks each proposed action against the agent's authorized intent at sub-millisecond latency, blocking out-of-scope calls before they run.

AI Security Posture Management applies zero-trust baselines to platforms including AWS Bedrock and flags overly permissive roles. Runtime guardrails stop prompt injection that tries to steer agents toward credential stores.

Trustworthy adoption depends on least-privilege agent identities that are enforced continuously, not assumed from defaults.

Incident Scorecard Details

Total AISSI Score: 6.25/10

Criticality: 8, Other agents' conversations, memory, and stored secrets were reachable. AISSI weighting: 25%

Propagation: 8, One agent could reach every agent in the account and region. AISSI weighting: 20%

Exploitability: 4, Public research with a detailed chain, no observed exploitation. AISSI weighting: 15%

Supply Chain: 7, Risk came from default settings of a managed AWS platform. AISSI weighting: 15%

Business Impact: 4, Defaults changed before publication with no reported harm. AISSI weighting: 25%

Sources

Third-Party Sources

• Dark Reading: 'AgentCorruption' Puts AWS Environments At Risk With Single Prompt
• Let's Data Science: AWS Updated AgentCore After AgentCorruption Research

PointGuard AI Sources

• PointGuard AI Agent Identity and Access Security
• PointGuard AI Security Posture Management
• PointGuard AI Runtime Guardrails