AgentCorruption: How A Single Prompt Collapsed The Entire Cloud Security Model

What it is

Zenity Labs research on Amazon Bedrock AgentCore, called AgentCorruption. A single prompt to any exposed agent could return IAM credentials from the instance metadata service (IMDS). Those credentials gave access to all AgentCore agents in the same AWS account and region. This is the overview of a five-part series; the page links four detailed posts.

How it works

AgentCore agents run in Firecracker MicroVMs without enough network isolation. Any agent tool that makes HTTP requests sends them from inside the instance, which creates an SSRF primitive. A prompt injection told the agent to call the link-local address 169.254.169.254, and IMDS returned the temporary credentials of the agent's execution role.

The default role was not scoped to one agent. It covered AgentCore resources across the whole account region. The post names these permissions and what each enabled:

• DescribeLogGroups: discover every agent ID in the region.
• ECR pull rights: ECR repository names matched agent IDs, so any agent's image could be pulled.
• bedrock-agentcore:InvokeAgentRuntime: invoke any agent in the region, giving lateral movement.
• bedrock-agentcore:ListEvents: read all conversations across agents, users and sessions.
• bedrock-agentcore:CreateEvent on BedrockAgentCoreMemory: write memories into any agent with long-term memory enabled, persistently changing its behaviour and goals.
• bedrock-agentcore:GetResourceApiKey and secretsmanager:GetSecretValue: read the tool credentials that AgentCore Identity and Gateway are meant to keep from the agent.

flowchart LR
    A[Prompt to exposed agent] --> B[SSRF to IMDS]
    B --> C[Role credentials]
    C --> D[Region-wide default role]
    D --> E[Invoke agents / read chats]
    D --> F[Poison memory]
    D --> G[Steal secrets]

Preconditions / Affected

• The attacker needs only chat access to one agent whose tools can make HTTP requests.
• Impact reaches every AgentCore agent in the same account and region.
• Memory poisoning applies only to agents with long-term memory enabled.
• The role was the AgentCore default. The post does not say whether custom roles were affected.

What to do

The post states that all issues are patched. AWS made two changes:

• Report 1 (IMDS access): as of 14 February 2026, AgentCore uses IMDSv2 only, and all newly deployed agents launch with IMDSv2.
• Report 2 (blast radius): by 29 September 2026, AWS removed the default-role permissions for wide agent execution, reading private conversations and reading Secrets Manager secrets across the region. Other permissions were also restricted.

The post gives no commands. AWS's statement recommends least-privilege execution roles and points to its AgentCore credential management, runtime permissions and security best practices docs.

Caveats

• AWS closed Report 1 as "informative" on 12 April 2026. Its statement calls the behaviour "documented and expected": agents can read their own execution role credentials through the metadata service.
• The default role was unchanged on 22 June 2026, and the change was first seen on 29 September 2026. Agents deployed before the fixes may need their roles checked, but the post does not say how existing deployments are handled.
• Timeline: reports filed 25 December 2025 and 12 January 2026.
• The post does not describe a detection method, and it does not state whether IMDS is still reachable from agent tools under IMDSv2.