AWS AgentCore: a single request was enough to hijack AI agents, Zenity says

On October 8, the research lab of Zenity unveiled “AgentCorruption,” a chain of weaknesses in Amazon Bedrock AgentCore, the AWS service used to deploy AI agents in the cloud. According to the researchers, a simple message sent to a publicly accessible agent was enough to take control of the other AgentCore agents in the same AWS account and region. The work was presented at the SecTor 2026 conference in Toronto.

How the attack worked

According to Zenity, the chain had four steps:

1. through a prompt injection, the agent was tricked into using a common web request tool to query the AWS instance metadata service (IMDS);
2. that service returned the credentials of the machine the agent was running on;
3. those credentials matched a default role whose permissions covered all AgentCore agents in the account and region;
4. the researchers were then able to discover and invoke the other agents through poorly protected internal interfaces.

Zenity says it was able to read private conversations and long-term memories, retrieve the agents' source code, and extract API keys, OAuth tokens and secrets stored in AWS Secrets Manager. The researchers were also able to plant fake “memories”: the agent still appeared to belong to the company, but followed the attacker's instructions and passed conversations on to them.

AWS disputes the findings

Zenity says it alerted AWS as early as December 25, 2025. According to Zenity, AWS first classified the report as “informational,” then reduced the permissions of the default role. That role can no longer invoke other agents or access secrets. No CVE identifier has been assigned.

In a statement to The Next Web, AWS said the research “inaccurately presents expected and documented behavior” as a vulnerability. AWS also told Zenity that, since February 14, new agents have been deployed with IMDSv2 only, a version that requires a session token.

Michael Bargury, co-founder and chief technology officer of Zenity, sums up what is at stake: cloud security rests on segmentation and least privilege. Companies will have to balance agent autonomy against limiting agents' permissions.

Best practices

• One role per agent: do not share a broad IAM (identity and access management) role across several agents, and grant only the permissions needed. AWS, for its part, recommends giving execution roles only the permissions strictly necessary for their agents.
• Enforce IMDSv2 and block access to the metadata service when it is not essential.
• Treat agent memory as sensitive data: monitor it and purge it regularly.
• Limit the tools that can send outbound network requests, especially for publicly exposed agents.