Loading story…
Zenity Labs reported an attack chain dubbed AgentCorruption that could let an external attacker obtain temporary AWS credentials through a single malicious prompt sent to a public-facing Amazon Bedrock AgentCore agent. Prompt injection induced the agent’s web or shell tool to access instance metadata endpoints, exploiting insufficient network isolation. Overly broad execution-role permissions then enabled access to other agents, container images, source code, conversations, memories, and connected-service secrets within the same AWS account and region. Researchers also demonstrated persistent memory manipulation that could influence agent behavior in future sessions. The findings describe a demonstrated attack chain, not a confirmed customer breach.
Zenity began disclosure in December 2025, and AWS made IMDSv2 mandatory on February 14, 2026. Excessive permissions remained unresolved during a June 22 check, but Zenity said AWS had addressed the outstanding issues by September 29, including removing broad permissions. AWS disputed the vulnerability characterization, saying execution-role credential access was expected behavior. Organizations using AgentCore should enforce least-privilege execution roles, restrict agent network access, monitor credential use and memory changes, and implement controls to prevent bypassing AgentCore Gateway.
Track how attackers are adapting to this technology.
9 events from the most recent confirmed update back to the earliest known activity.
Zenity's final review found that AWS had addressed the outstanding problems, including removing permissions enabling broad agent invocation, chat access, and AWS Secrets Manager access. Zenity stated that the reported issues were fixed.
A follow-up check by Zenity found that AgentCore's excessive permissions remained unremediated despite the earlier metadata-service update and report closure.
AWS classified Zenity's report as informative and closed it, citing the switch to IMDSv2.
AWS updated AgentCore to require IMDSv2, addressing the IMDSv1 metadata-access path described in Zenity's report.
Zenity provided AWS with additional findings showing that default execution-role permissions were not restricted to an individual agent. Exposed credentials could consequently enable access to other agents and sensitive resources in the same AWS account and region.
Zenity disclosed the metadata-access issue to AWS, showing how an agent could be prompted to retrieve temporary credentials for its execution role.
During its late-2025 investigation, Zenity Labs found that AgentCore agents could access instance metadata endpoints using IMDSv1. Researchers attributed the exposure to insufficient network isolation within AgentCore's Firecracker microVMs.
AWS described access to an agent's own execution-role credentials as expected and documented behavior, disputing the characterization as a vulnerability. It recommended least-privilege execution roles and controls preventing callers from bypassing AgentCore Gateway through direct runtime access.
Zenity described how a single prompt could trigger metadata requests through an agent's tools, exposing credentials usable to retrieve container images, read conversations, and access connected-service secrets. Researchers also demonstrated creating false memories that could influence future sessions; the reporting did not establish an actual customer breach.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecysecurity.news
Open sourcecybersecuritynews.com
Open sourcetheregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Unit 42 found that AWS AgentCore Harness’s default-enabled `shell` and `file_operations` tools can let an indirect prompt injection achieve arbitrary command execution inside an agent runtime. In testing, the shell ran as root and read memory from the root-owned harness runtime, exposing a plaintext Amazon Cognito JWT that AgentCore Identity had resolved for a simulated MCP service account; researchers replayed the token remotely to access simulated customer PII. AWS classified the May 2026 report as informative under its shared-responsibility model, pointing to customer-managed controls including `allowedTools` scoping and egress filtering. Organizations using AgentCore Harness should restrict permitted tools for each invocation, apply least privilege to Identity-vault service accounts, and monitor outbound network traffic from harness containers for credential exfiltration or token replay activity.
Sep 22, 2026
Researchers disclosed multiple **Amazon Bedrock AgentCore** security issues that can break the isolation expected in AI agent execution environments. One finding showed that *AgentCore Code Interpreter* sandboxes allowed outbound **DNS** queries despite a no-network-access design, enabling attackers to create a bidirectional command-and-control channel, exfiltrate data over DNS, and obtain an interactive shell. The impact depends heavily on the IAM role attached to the runtime: overprivileged access could expose AWS resources such as **S3** and allow broader compromise of data and connected services. A separate Bedrock AgentCore issue, tracked as **`CVE-2026-4269`**, affected the *AgentCore Starter Toolkit* and allowed **unauthenticated remote code execution** through **S3 bucket squatting**. By registering a predictable bucket name before a victim's build process, an attacker could inject malicious content into the agent runtime, gain control of the execution environment, manipulate model inputs and outputs, and potentially achieve lateral movement based on the runtime's IAM permissions. The flaw also introduced a **software supply chain** risk because compromised dependencies could be cached or embedded into CI/CD artifacts and persist across later deployments.
Jun 29, 2026
Multiple disclosures highlighted how AI agent platforms can be turned into high-impact attack paths through weak isolation, overbroad credentials, and insecure supply chains. A critical flaw in Omnigent tracked as **`CVE-2026-62674`** and **`GHSA-jrrm-9hc7-2v3h`** lets an authenticated user overwrite a shared agent bundle and plant a malicious stdio MCP server, causing later sessions to execute attacker-controlled commands with runner privileges; the issue was fixed in version **`0.3.0`**. Rubrik Zero Labs also reported a patched Microsoft Copilot sandbox escape that could have enabled movement from the assistant’s isolated environment toward Azure backend infrastructure and exposed tenant data including SharePoint and OneDrive content. Separate reporting showed that AI coding and orchestration systems remain vulnerable even when attacks do not directly exploit memory corruption or classic software bugs. A malicious pull request briefly entered Amazon Q Developer’s VS Code extension build pipeline and attempted to inject instructions that would wipe local files and cloud resources, though Amazon said the payload never executed because of a formatting error and the code was removed in a clean rebuild. Researchers and practitioners across the sector warned that tokenizer tampering, shared bot environments, and incomplete audit trails can let agents exceed intended task scope or spread borrowed human credentials across tools and sessions, while vendors including AWS and Roblox are responding with sandboxed evaluation environments, least-privilege designs, stronger release controls, and auditable agent identities.
Aug 24, 2026