One prompt unlocked every AWS agent in the region

Zenity Labs disclosed AgentCorruption in early October, presenting the research at SecTor 2026 in Toronto: a chain of flaws in Amazon Bedrock AgentCore that turned chat access to a single public-facing agent into control of every AgentCore agent in the same AWS account and region. The Register published the details on October 9.

The chain is worth following step by step, because the interesting part is not the prompt. The prompt just asked the agent to fetch a URL, a credential endpoint, and return the content in raw JSON. What happened after was pure cloud plumbing.

AgentCore runs agents in Firecracker microVMs. Zenity found the microVM did not sufficiently isolate the network, so the agent could be directed to hit the instance metadata service (IMDS), which hands out temporary credentials for the workload's IAM role. Late last year AgentCore still used IMDSv1, the older variant without the request protections that IMDSv2 added. One prompt, one fetch, and the researchers had the agent's temporary credentials.

The credentials were the real story. They belonged to AgentCore's default execution role, and that role was not scoped to the one agent. It was scoped to all AgentCore resources in the region. From there, Zenity reports, the researchers could enumerate the company's other agents in that region, log into Amazon Elastic Container Registry, pull the agent container images, and run each as root to inspect the source code. They could discover agent memory resources and extract users and their sessions, the conversations. They could fetch secrets from AWS Secrets Manager. And they could write memories across agents and users, persistent state that would keep altering agent behavior in future sessions after the attacker's session ended. "These in turn would persistently alter agent behaviour and hijack the agents' goals across future sessions," Zenity's Tamir Ishay Sharbat and Lana Salameh told The Register.

Note what is absent from that chain. No model failure. No prompt injection that bypassed a safety filter. The model's only job was to make one HTTP request when asked. Everything after that was IAM. An agent platform that hands its execution roles region-wide permissions has built a blast radius the size of the region, and a single chat interface into one agent is a key to the whole thing. This is the quiet version of the attack wave Talos described last week: no noise at all, just IAM doing what it was told (the rundown).

The disclosure timeline matters too. Zenity told AWS in December 2025, followed up in January 2026 about the overprivileging. On April 12, 2026, AWS called the report "informative" and closed it, noting AgentCore had moved to IMDSv2-only as of February 14, 2026. But the permissions problem persisted: Zenity checked on June 22, 2026 and found it unremediated. It was only after a final review on September 29, 2026 that Zenity observed AWS had addressed the problems, clearing the way for public disclosure. That is a roughly nine-month arc from first report to full remediation, with the role-scoping fix landing months after the IMDSv2 fix.

Amazon, after The Register's publication, said Zenity's research misrepresents documented behavior as a vulnerability and that developer error would be required to enable the attack. The Register asked for clarification, noting that is not the scenario Zenity described. The dispute is unresolved at publication time, and it is the part to watch: whether the overpermissioned default was ever what customers actually got, or whether Zenity's test setup diverged from the default.

Whatever the answer, the operator checklist stands on its own. Audit the execution role your agents actually run with, on every managed agent platform, not just AWS. Verify IMDSv2 enforcement; IMDSv1 has been a known credential source for a decade. Rotate any secret that was ever reachable through a role you did not personally scope. And treat agent memory as a persistence surface: anything the agent can write to, an attacker with its credentials can poison. Harvey published the most detailed public template for governing agent tool use at runtime last week (the write-up), and its first principle is that review is not enough; AgentCorruption demonstrates the same principle at the IAM layer.

The model obeyed the prompt. That was never the problem. The role obeyed the credentials, and nobody had asked what the role was allowed to touch.