Zenity Reports Critical Security Vulnerabilities in AWS AgentCore
Zenity Labs has disclosed a severe security issue affecting AWS AgentCore agents within a single account and region. According to their research, a single prompt to a public-facing AI agent granted complete control over all other agents in the account, allowing unauthorized access and potential data exfiltration.
Key Findings:
-
Unrestricted Access: AgentCore's default role granted agents permissions to access resources across the entire AWS account and region, including private conversations, source code, and stored credentials.
-
Persistence: Write access to agent memory ensured the takeover was persistent, allowing attackers to manipulate agent behavior over time.
-
AWS Response: AWS has acknowledged the issues, stating that the behavior is documented and not a vulnerability. However, they have also implemented changes, such as restricting newly deployed AgentCore agents to use IMDSv2.
Research Details:
Researchers at Zenity Labs discovered a chain of vulnerabilities, dubbed "AgentCorruption," in the Amazon Bedrock AgentCore service. They demonstrated that an attacker could:
- Read private conversations
- Copy agent source code
- Steal stored credentials
- Plant malicious memories, altering agent behavior
Timeline:
- 25 December 2025: Zenity reported metadata access issues to AWS.
- 12 January 2026: They reported the broad default role.
- April 2026: AWS responded, acknowledging the issues and mentioning updated deployment practices.
Correction:
An earlier version of this article incorrectly stated that the research covered agents across a single region. It has been corrected to reflect that it was within a single AWS account and region.
Impact and Recommendations:
This discovery highlights the potential risks associated with AI agent segmentation and access controls. As AI agents become more integrated into cloud environments, ensuring robust security measures is crucial to prevent similar incidents.