One prompt let researchers take over every AWS AgentCore agent in a region
Researchers at Zenity Labs used a single prompt to one public-facing AI agent on Amazon Bedrock AgentCore to take over every AgentCore agent in the same AWS account and region. The security firm published the research on Thursday, alongside a talk at the SecTor 2026 conference in Toronto.
Researchers at Zenity Labs discovered a critical vulnerability in Amazon Bedrock AgentCore, allowing them to take over all agents in an AWS account and region using a single prompt.
What happened
Zenity Labs researchers discovered a critical security flaw in Amazon Bedrock AgentCore, allowing them to take over all AI agents in an AWS account and region using a single prompt. The vulnerability, named AgentCorruption, enabled them to access private data, steal credentials, and alter agent behavior. The attack exploited a default role with broad permissions and used memory manipulation to create a persistent backdoor.
Why it matters
This discovery highlights significant security risks in AI agent systems, particularly in cloud environments. It underscores the need for better access control and segmentation in AI agent architectures to prevent unauthorized access and manipulation.
- AI agents in cloud environments require strict access controls and segmentation to prevent unauthorized access.
- Memory manipulation can be used to create persistent backdoors in AI systems.
- Cloud providers must continuously update security measures to address emerging vulnerabilities in AI infrastructure.
The bigger picture
The vulnerability could lead to data breaches, unauthorized access to sensitive information, and manipulation of AI agents, posing serious risks to cloud security and user privacy.
The discovery of AgentCorruption highlights critical security flaws in AI agent systems and the importance of robust access controls and segmentation in cloud environments.
Technical details
- AgentCorruption exploited a default role with broad permissions across an AWS account and region.
- The attack used the instance metadata service (IMDS) to retrieve temporary credentials.
- Memory manipulation allowed researchers to inject fake conversation events, altering agent behavior.
- AWS updated its metadata service to require session tokens for requests, but some vulnerabilities remained.
FAQ
What is AgentCorruption?
AgentCorruption is a chain of vulnerabilities in Amazon Bedrock AgentCore that allowed researchers to take over all agents in an AWS account and region using a single prompt.
How did the researchers exploit the vulnerability?
Researchers exploited a default role with broad permissions and used memory manipulation to inject fake conversation events, altering agent behavior.
What changes did AWS make to address the issue?
AWS updated its metadata service to require session tokens for requests, but some vulnerabilities, such as access to private conversations, remained unresolved.
Why is this vulnerability significant?
This vulnerability highlights the risks of insufficient access control in AI agent systems, potentially leading to data breaches and unauthorized manipulation of AI behavior.
What are the implications for cloud security?
The discovery underscores the need for stronger security measures, including segmentation and least-privilege access, to protect AI agents and user data in cloud environments.
This summary and analysis were generated with AI from the original article and may contain errors. Read the original for the full story.
Read the full story
Originally published by The Next Web AI on Oct 8, 2026.
Comments
Sign in to join the discussion.