A single prompt was enough to hijack every AI agent in an AWS account, Zenity researchers found
decoder ·
Researchers at Zenity Labs discovered a critical vulnerability chain in Amazon's Bedrock AgentCore platform, dubbed 'AgentCorruption,' which allowed them to hijack every AI agent within an AWS account and region using a single prompt. By exploiting a lack of proper isolation, they tricked one public agent into revealing its internal AWS credentials via the Instance Metadata Service. These stolen credentials granted attackers broad default permissions, enabling access to source code, private conversations, and long-term memory across all agents in the same environment. The attack demonstrated how a single compromised entry point could lead to systemic data theft and manipulation of autonomous agents. AWS has since implemented partial fixes by enforcing IMDSv2 and tightening default execution roles for new deployments. Despite these updates, Zenity advises companies to manually assign stricter, least-privilege roles to their AI agents to ensure robust security. This incident highlights the ongoing tension between cloud segmentation principles and the operational freedom required by AI systems.
decoder