Back Darkreading

'AgentCorruption' Puts AWS Environments At Risk With Single Prompt

Darkreading •Rob Wright • October 8, 2026

A now-patched vulnerability in AWS Bedrock AgentCore could allow an attacker to use one AI chatbot to take over an organization's entire fleet.

SecTor 2026 – Toronto – If one thing has become apparent over the past year, it's that AI and cloud computing don't mix well.

That's according to Tamir Ishay Sharbat, director of security research at AI security vendor Zenity Labs, who detailed a now-patched flaw in AWS Bedrock AgentCore during a session at SecTor 2026 on Wednesday. Bedrock AgentCore , which launched last year, is AWS's managed platform for deploying and operating agents.

But Sharbat and Zenity's research team tested the platform and found that agents deployed through Bedrock AgentCore could access the organization's Instance Metadata Services (IMDS), which contains sensitive data such as temporary credentials, instance IDs, and configurations. With a single prompt to a public facing chatbot, Sharbat discovered he could not only gain control over that specific agent but take over all agents on in the same AWS account and region.

Related: Cloudflare Announces Public Certificate Authority for the Post-Quantum Web

"Cloud and AI are kind of like fire and ice," Sharbat said. "And we're going to see how mixing them might go terribly."

'AgentCorruption' Jeopardizes AWS Instances

The core issue for Bedrock AgentCore involves a flaw with IMDS, which Zenity calls " AgentCorruption ." Sharbat told the audience that IMDS has been a weakness for cloud environments "since the beginning," and highlighted the 2019 Capital One data breach . In that incident, the attacker used an SSRF flaw to access the company's EC2 instance then then send requests to the IMDS to retrieve credentials and other sensitive data.

The Capital One breach, Sharbat said, is "all because they didn't implement least privilege" for the metadata service. The same approach applies with an AgentCorruption attack, except the threat actor is manipulating a public-facing agent to do the work.

Zenity researchers discovered they could send a request to the IMDS via a support agent for temporary credentials, and the agent complied. This is because, according to Zenity, an agent deployed through the AgentCore platform runs inside a Firecracker MicroVM, which doesn't have the necessary network isolation in place. Therefore, an attacker can use any agent with the ability to make HTTP requests to issue such a request to the IMDS' endpoint within the instance.

"That was so freakin' easy," Sharbat said.

With the temporary credentials in hand, Sharbat and his team began exploring how far their access could go, and how much of a blast radius there would be in an AgentCorruption attack. They discovered that the default AgentCore role included broad permissions across all AgentCore resources in the entire region, not just for this specific type of agent. As a result, the researchers could invoke additional agents, read sessions, and even access an organization's secrets from AWS’s secrets manager.

Related: JadePuffer AI Actor Compromises Azure Tenant in Destructive Cloud Attack

In addition the moving laterally across an AWS environment and obtaining privileged accounts, Sharbat said they could also engage in memory poisoning attacks against the agents. In short, a single prompt to an over-privileged public-facing agent could lead to a full compromise of an entire AgentCore region.

Mitigating AgentCorruption Attacks

Sharbat said AgentCorruption illustrates the inherent conflict between cloud environments — which should implement isolation, the principle of least privilege (POLP), and strict access controls — and agentic AI, which typically have wide access and broad permissions across a network.

Zenity initially reported the IMDS flaw to AWS in December, and later followed up with an additional report AgentCore’s overprivileged default role and the wide blast radius. In response, AWS updated AgentCore in February so that all new agents deployed on the platform use IMDSv2, which requires authentication.

Additionally, Zenity said AWS altered AgentCore's default role, removing the permissions that allowed agents to invoke other agents, read private conversations, and access secrets stored in AWS Secrets Manager, among other restrictions.

Related: How to Build a SASE Framework for Modern Cybersecurity

Sharbat said Zenity hasn't seen any evidence of the flaw being exploited in the wild prior to AWS's fix because there's "security through obscurity" at work with AgentCore — it's difficult to tell what agents are deployed via the platform, which benefits AWS customers.

However, Sharbat tells Dark Reading that while he's not aware of a way to look up who's running their agents on AWS BedRock, "I'm 100% sure there are ways to do it."

Sharbat says Zenity's team currently is examining other cloud platforms to see if similar AgentCorruption issues exist. While the company isn't disclosing what those platforms are just yet, Sharbat says the IMDS weakness likely isn't limited to AgentCore.

"It's something that agent builders need to be aware of," he says. "It's not specific to AWS."

The best approach, Sharbat says, is to make sure the privileges are limited for the agent's specific role. "Even if someone gets to the IMDS, the blast radius will be a lot smaller."

Oct 6, 2026 TO Oct 8, 2026

Metro Toronto Convention Centre | Toronto

Now in its 20th year, SecTor has built a reputation of bringing together experts from around the world to their latest research and techniques involving underground threats and corporate defences. The conference provides an unmatched opportunity for IT Security Professionals, Managers & Executives to connect with their peers and learn from their mentors.

Senior News Director, Dark Reading

Rob Wright is a longtime reporter with more than 25 years of experience as a technology journalist. Prior to joining Dark Reading as senior news director, he spent more than a decade at TechTarget's SearchSecurity in various roles, including senior news director, executive editor and editorial director. Before that, he worked for several years at CRN, Tom's Hardware Guide, and VARBusiness Magazine covering a variety of technology beats and trends.

Prior to becoming a technology journalist in 2000, he worked as a weekly and daily newspaper reporter in Virginia, where he won three Virginia Press Association awards in 1998 and 1999. At TechTarget and Dark Reading, he has won several Azbee awards, including the 2026 National Silver Award for a series on vibe coding.

At Dark Reading, Rob currently covers security operations, cloud security, and Internet infrastructure. He has a keen interest in malvertising activity and the certificate authority industry, and has written extensively on both topics. He graduated from the University of Richmond in 1997 with a degree in journalism and English. A native of Massachusetts, he lives in the Boston area.

Want more Dark Reading stories in your Google results?

The State of Cloud Security: The Latest Challenges

How Organizations Are Managing Incident Response

How Enterprises Are Developing Secure Applications

Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy

Essential News & Insights from Black Hat USA 2025

Building Cyber Resilience: Beyond Prevention to Recovery

The Frontier AI Threat: Closing the Mobile Gap in Your Exposure Management Strategy

Static Analysis, Smarter Triage, Agentic Depth: A Practical AppSec Stack for AI-Driven Development

Effective Alert Triage: Reducing Noise and Finding Real Threats

Cybersecurity Outlook 2027

Lone Attacker Uses AI to Breach AWS Cloud Environment in 72 Hours

CSA: CISOs Should Prepare for Post-Mythos Exploit Storm

APT41 Delivers 'Zero-Detection' Backdoor to Harvest Cloud Credentials

TeamPCP Turns Cloud Infrastructure Into Crime Bots

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Vulnerability in AWS Bedrock AgentCore Exposes AI Agents to Hijacking Researchers from Zenity Labs discovered a vulnerability in AWS Bedrock AgentCore that allowed an attacker to take control of all AI agents within the same AWS account and region using a single prompt to a public-facing agent. The flaw, termed 'AgentCorruption', exploited inadequate isolation of agents and broad default permissions, enabling access to sensitive data such as internal AWS credentials, private conversations, and source code. AWS has partially addressed the issue by tightening default execution roles and restricting access to internal metadata, but experts recommend further manual role assignments for security. The vulnerability highlights long-standing issues with AWS's Instance Metadata Service (IMDS) and its implications for cloud security. The research indicates that attackers could manipulate agent memory and exfiltrate credentials from AWS Secrets Manager, posing a significant risk to organizations relying on AI agents. 3 sources 70

Extracted Entities

'AgentCorruption' Puts AWS Environments At Risk With Single Prompt

The full story

Extracted Entities

Attack Types (1)

Companies (2)

CWE Weaknesses (1)

Domains (1)

MITRE ATT&CK (2)

Platforms (3)

Tools (1)