Zenity Labs researchers discovered a vulnerability chain in the Amazon Bedrock AgentCore platform allowing the hijacking of all AI agents in an AWS account and region through a single prompt. The flaw enabled researchers to access internal AWS credentials, source code, private conversations, and agent memory via a public-facing agent. Amazon Bedrock AgentCore is designed for running enterprise AI agents, but the platform lacked proper isolation and exposed temporary credentials through the internal metadata service.
The security researchers built a test agent using the open-source AWS Strands framework and successfully instructed it to query the metadata service and exfiltrate the credentials. Because AgentCore granted broad default permissions across the entire region rather than isolating individual agents, the stolen credentials allowed the researchers to list, inspect, and manipulate every agent in the same account and region. This systemic exposure granted attackers access to sensitive data packages containing API keys and passwords, enabling lateral movement from public customer service agents to internal finance tools.
AWS has responded by partially fixing the issue through tighter default execution roles and making it harder for new agents to retrieve internal metadata. However, Zenity researchers still advise companies to manually configure stricter, least-privilege roles for their AI agents to prevent unauthorized access. This discovery highlights critical security challenges regarding privilege management and isolation in enterprise multi-agent platforms.