The Pulse
Zenity Says One Prompt Reached Every Agent in an AWS Account
Zenity Labs says a prompt to one public Amazon Bedrock AgentCore agent exposed other agents in the same AWS account and region. AWS disputes Zenity’s description of the behavior as a vulnerability, while Zenity says AWS later changed defaul
AI.info Team · Written with AI ·
On October 8, Zenity Labs published research saying a prompt sent to one public-facing Amazon Bedrock AgentCore agent let its researchers reach other agents in the same AWS account and region. The researchers called the chain of issues AgentCorruption. They say it exposed private conversations, agent source code and stored credentials, and allowed changes to agents’ long-term memories. AWS disputes the description of the behavior as a vulnerability.
A prompt led to temporary AWS credentials
Zenity’s account begins with an agent equipped with a tool that could make outbound web requests. The researchers prompted it to contact AWS’s Instance Metadata Service, an endpoint that can provide temporary credentials to a cloud workload. Zenity says the AgentCore environment did not block the request, allowing the agent to return credentials associated with its execution role.
Those credentials were the step from one agent to the broader account. Zenity says the default role was not limited to the agent that received it; its permissions extended across AgentCore resources in the same account and region. Using the role, researchers say they could find other agents, invoke them and download their container images, which can contain source code and configuration.
“We discovered that agents deployed through AgentCore could access their instance’s IMDS endpoints,” write Tamir Ishay Sharbat and Lana Salameh in Zenity’s research. The team says it reproduced the initial access through more than one tool, including a shell tool, and argues the issue lay in the platform’s network isolation rather than in a particular tool.
Memory changes extended the researchers’ access
Zenity says the role also let researchers read private conversations and retrieve credentials held in AWS Secrets Manager. Those secrets can include keys used to connect agents to services outside AWS. The company says access to agent memory created a longer-lasting route: researchers wrote instructions into memory that could alter how an agent behaved in later sessions.
In the example Zenity describes, the stored instruction told an agent to consult a web page controlled by the researchers before replying. Changing the page could change what the agent was instructed to do, without adding another memory entry. Zenity says a video demonstration showed the agent forwarding a user’s conversation to a server controlled by the researchers.
The findings describe a research demonstration, not a report of a customer breach. The scope Zenity gives is also specific: AgentCore agents within one AWS account and region, not every agent running on AWS. The distinction matters because the attack’s reach depended on the permissions attached to that environment.
AWS rejects Zenity’s vulnerability framing
AWS told The Next Web that the research “inaccurately paints expected and documented behavior as a vulnerability.” The company said access to resources in another AWS account requires developers to grant permissions both on an agent’s execution role and on the target resource. AWS recommended that customers give execution roles only the permissions their agents need.
That response contests Zenity’s characterization, while Zenity’s findings focus on the breadth of the default role and the ability to obtain its credentials through an agent. AWS’s published AgentCore security guidance likewise advises customers to restrict permissions to what an application requires. The two accounts leave customers with a practical question: whether their deployed agents and roles match the access they intended to grant.
Zenity says AWS changed its defaults
Zenity says it first reported metadata access to AWS on December 25, 2025, and reported the broad role on January 12, 2026. According to the researchers, AWS switched newly deployed agents to IMDSv2 on February 14. Zenity says that on September 29, it found that AWS had removed permissions to invoke other agents, read private conversations and access Secrets Manager, while narrowing other permissions.
AWS’s spokesperson statement to The Next Web did not confirm that timeline or describe the changes as fixes. Zenity’s report says the company disclosed its findings alongside a presentation at SecTor 2026 in Toronto. Its central technical claim is that one public-facing agent, given a route to the metadata endpoint and a broad execution role, provided a path to other AgentCore agents in the same account and region.