AWS AgentCore security undone by prompt requesting credentials
Tokens transmitted in metadata, weak VM isolation, and expansive permissions make hacking a lot easier
This article details a security vulnerability in AWS AgentCore that allowed attackers to extract sensitive credentials through a malicious prompt, exposing risks in cloud-based AI agent systems.
What happened
A researcher (referred to as Bob) exploited AWS AgentCore's security flaws by prompting an AI agent to access instance metadata, extracting credentials that enabled full account compromise. Researchers from Zenity Labs disclosed the vulnerability to AWS, which eventually patched the issue by enforcing IMDSv2 and revoking excessive permissions.
Why it matters
The incident highlights critical risks in cloud-native AI systems, emphasizing the need for strict IAM policies, secure VM isolation, and proper metadata handling to prevent credential-based attacks.
- Avoid overprivileged IAM roles in cloud environments
- Enforce IMDSv2 for metadata access security
- Implement strict network isolation for containerized AI workloads
- Regularly audit AI agent permissions and access controls
The bigger picture
The vulnerability demonstrated how AI agent systems could be exploited to compromise entire cloud environments, prompting AWS to update its security practices and reinforcing the importance of secure infrastructure design.
The AWS AgentCore vulnerability underscores the critical need for robust security practices in AI infrastructure, particularly around credential management and virtual machine isolation.
Technical details
- Instance Metadata Service (IMDS) endpoints
- Firecracker MicroVM isolation mechanisms
- Server-side request forgery (SSRF) attacks
- IAM role overprivilege
- IMDSv1 vs. IMDSv2 security differences
FAQ
What was the main security flaw in AWS AgentCore?
AgentCore's use of IMDSv1 allowed attackers to extract temporary credentials through metadata, combined with weak VM isolation and overprivileged IAM roles.
How did the attack exploit the AI agent?
By prompting the agent to access instance metadata, attackers could retrieve credentials and use them to hijack other agents, access secrets, and modify agent behavior.
What changes did AWS make to address the issue?
AWS transitioned to IMDSv2 exclusively and revoked excessive permissions from the default AgentCore IAM role to prevent lateral movement.
This summary and analysis were generated with AI from the original article and may contain errors. Read the original for the full story.
Read the full story
Originally published by The Register on Oct 9, 2026.
Comments
Sign in to join the discussion.