{"schema_version":"0.8.0","id":"LR-2026-0153","record_version":3,"title":"AgentCorruption: prompt-injected Bedrock AgentCore agent exfiltrates execution-role credentials via IMDS","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":51.7,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":8.0,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true},"gate_version":"gate-2026-09-30.6","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-10","extraction_run_id":null},"system":{"model_name":null,"model_version":null,"developer":"Amazon","harness":"Amazon Bedrock AgentCore","tools_granted":["HTTP","shell"],"permissions_scope":"The execution role Zenity examined was not restricted to the compromised agent. Its permissions extended across AgentCore resources within the account and region, turning credential theft into a broader compromise.","autonomy_level":"unknown","guardrails_present":[],"deployment_context":"production","tier":"enterprise","lifecycle_stage":"production","integration_type":"agentic_with_tools","intended_use":null,"safeguard_state":null,"production_intended":true},"event":{"date_occurred":null,"date_disclosed":"2026-10-10","incident_class":"security_compromise","failure_class":"injection_triggered","agent_involved":true,"secondary_failure_classes":["credential_misuse","data_exfiltration"],"trigger":"prompt_injection","duration":null,"detection_method":"public_researcher","summary":"An exposed Amazon Bedrock AgentCore agent with HTTP or shell tools, running in a Firecracker microVM, was tricked by a malicious prompt into contacting the metadata endpoint 169.254.169.254, an SSRF that exposed its execution-role credentials. The role was not scoped to that agent, so attackers used the credentials to reach other agents, internal agents, users, sessions and stored conversation content. Zenity researchers discovered and named the chain AgentCorruption. AWS said newly deployed agents used IMDSv2 from February 14, 2026, and researchers saw substantial restrictions to the default execution role by their September 29 review.","tags":["prompt-injection","ssrf","credential-theft","cloud","agent","memory-poisoning"],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":"A malicious prompt tricked an agent with HTTP or shell tools into contacting the metadata endpoint, causing an SSRF that exposed execution-role credentials.","responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":"a malicious prompt","time_to_contain":null,"operations_paused":null,"remediation":"AWS subsequently reported that newly deployed agents used IMDSv2 beginning February 14, 2026. Researchers observed substantial restrictions to the default execution role during their September 29 review.","precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"major: The stolen execution-role credentials gave access across AgentCore resources in the account and region, including internal agents and stored conversation content, a live production compromise with unbounded scope.","harm_class":["third_party_security","privacy","operational"],"affected_description":"other agents in the same AWS account and region; internal agents; users and sessions; stored conversation content","protected_class_involved":null,"data_categories_exposed":["credentials","conversation_content"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://cyberpress.org/aws-bedrock-agentcore-flaw-2/","publisher":"news search (Google News index)","date":"2026-10-10","type":"press","title":"AWS Bedrock AgentCore Flaw Let Attackers Hijack AI Agents and Steal Cloud Credentials","archived_url":null,"attachment":"first_report"},{"url":"https://cyberpress.org/aws-bedrock-agentcore-flaw-2/?amp=1","publisher":"news search (Google News index)","date":"2026-10-10","type":"press","title":"AWS Bedrock AgentCore Flaw Let Attackers Hijack AI Agents and Steal Cloud Credentials","archived_url":null,"attachment":"fingerprint"}],"per_field_confidence":{"system.harness":"C","system.tools_granted":"C","system.permissions_scope":"C","system.tier":"D","system.lifecycle_stage":"D","system.integration_type":"D","system.production_intended":"D","system.developer":"C","system.deployment_context":"D","system.autonomy_level":"D","event.failure_class":"C","event.secondary_failure_classes":"C","event.tags":"C","event.adversarial_actor":"C","event.input_provenance":"C","event.remediation":"C","event.agent_involved":"C","event.trigger":"C","event.detection_method":"D","event.incident_class":"C","event.summary":"D","event.date_disclosed":"A","impact.harm_class":"C","impact.affected_description":"C","impact.data_categories_exposed":"C","impact.severity":"D","context.industry":"D","context.systemic_exposure":"C","context.shared_model_id":"C","context.denominator_available":"D","context.country":"D","event.failure_class_detail":"C","impact.severity_because":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"A newly disclosed attack chain in Amazon Bedrock AgentCore lets attackers with chat access to an exposed AI agent steal temporary cloud credentials and compromise other agents in the same AWS account and region."}],"system.harness":[{"source_index":0,"quote":"AgentCore runs containerized agents inside Firecracker microVMs."}],"system.tools_granted":[{"source_index":0,"quote":"Researchers showed that an agent with HTTP or shell tools could be tricked by a malicious prompt into contacting the metadata endpoint at 169.254.169.254."}],"system.permissions_scope":[{"source_index":0,"quote":"The execution role Zenity examined was not restricted to the compromised agent. Its permissions extended across AgentCore resources within the account and region, turning credential theft into a broader compromise."}],"system.deployment_context":[{"source_index":0,"quote":"A newly disclosed attack chain in Amazon Bedrock AgentCore lets attackers with chat access to an exposed AI agent steal temporary cloud credentials and compromise other agents in the same AWS account and region."}],"system.lifecycle_stage":[{"source_index":0,"quote":"A newly disclosed attack chain in Amazon Bedrock AgentCore lets attackers with chat access to an exposed AI agent steal temporary cloud credentials and compromise other agents in the same AWS account and region."}],"system.integration_type":[{"source_index":0,"quote":"Researchers showed that an agent with HTTP or shell tools could be tricked by a malicious prompt into contacting the metadata endpoint at 169.254.169.254."}],"system.production_intended":[{"source_index":0,"quote":"A newly disclosed attack chain in Amazon Bedrock AgentCore lets attackers with chat access to an exposed AI agent steal temporary cloud credentials and compromise other agents in the same AWS account and region."}],"event.failure_class":[{"source_index":0,"quote":"Researchers showed that an agent with HTTP or shell tools could be tricked by a malicious prompt into contacting the metadata endpoint at 169.254.169.254."}],"event.secondary_failure_classes":[{"source_index":0,"quote":"The resulting server-side request forgery exposed credentials associated with the agent’s execution role."},{"source_index":0,"quote":"Researchers exported them to a separate machine and verified that AWS recognized subsequent requests as originating from the compromised agent’s assumed role."}],"event.trigger":[{"source_index":0,"quote":"Researchers showed that an agent with HTTP or shell tools could be tricked by a malicious prompt into contacting the metadata endpoint at 169.254.169.254."}],"event.detection_method":[{"source_index":0,"quote":"The research, named AgentCorruption, connected prompt injection, metadata access, and excessive execution-role permissions."}],"event.tags":[{"source_index":0,"quote":"The research, named AgentCorruption, connected prompt injection, metadata access, and excessive execution-role permissions."},{"source_index":0,"quote":"The supplied overview additionally describes persistent memory poisoning against agents with long-term memory enabled."}],"event.adversarial_actor":[{"source_index":0,"quote":"A newly disclosed attack chain in Amazon Bedrock AgentCore lets attackers with chat access to an exposed AI agent steal temporary cloud credentials and compromise other agents in the same AWS account and region."}],"event.input_provenance":[{"source_index":0,"quote":"Researchers showed that an agent with HTTP or shell tools could be tricked by a malicious prompt into contacting the metadata endpoint at 169.254.169.254."}],"event.remediation":[{"source_index":0,"quote":"AWS subsequently reported that newly deployed agents used IMDSv2 beginning February 14, 2026. Researchers observed substantial restrictions to the default execution role during their September 29 review."}],"event.incident_class":[{"source_index":0,"quote":"A newly disclosed attack chain in Amazon Bedrock AgentCore lets attackers with chat access to an exposed AI agent steal temporary cloud credentials and compromise other agents in the same AWS account and region."}],"event.agent_involved":[{"source_index":0,"quote":"Researchers showed that an agent with HTTP or shell tools could be tricked by a malicious prompt into contacting the metadata endpoint at 169.254.169.254."}],"event.failure_class_detail":[{"source_index":0,"quote":"Researchers showed that an agent with HTTP or shell tools could be tricked by a malicious prompt into contacting the metadata endpoint at 169.254.169.254."}],"impact.harm_class":[{"source_index":0,"quote":"ListActors and ListSessions revealed users and sessions, while ListEvents exposed stored conversation content."},{"source_index":0,"quote":"CreateEvent and DeleteEvent enabled attackers to manipulate conversation history, potentially changing an agent’s decisions or removing contextual evidence."}],"impact.affected_description":[{"source_index":0,"quote":"A newly disclosed attack chain in Amazon Bedrock AgentCore lets attackers with chat access to an exposed AI agent steal temporary cloud credentials and compromise other agents in the same AWS account and region."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"The resulting server-side request forgery exposed credentials associated with the agent’s execution role."},{"source_index":0,"quote":"ListActors and ListSessions revealed users and sessions, while ListEvents exposed stored conversation content."}],"impact.severity_because":[{"source_index":0,"quote":"The execution role Zenity examined was not restricted to the compromised agent. Its permissions extended across AgentCore resources within the account and region, turning credential theft into a broader compromise."}],"context.industry":[{"source_index":0,"quote":"A newly disclosed attack chain in Amazon Bedrock AgentCore lets attackers with chat access to an exposed AI agent steal temporary cloud credentials and compromise other agents in the same AWS account and region."}],"context.systemic_exposure":[{"source_index":0,"quote":"The execution role Zenity examined was not restricted to the compromised agent. Its permissions extended across AgentCore resources within the account and region, turning credential theft into a broader compromise."}],"context.shared_model_id":[{"source_index":1,"quote":"A newly disclosed attack chain in Amazon Bedrock AgentCore lets attackers with chat access to an exposed AI agent steal temporary cloud credentials and compromise other agents in the same AWS account and region."}],"event.summary":[{"source_index":0,"quote":"Researchers showed that an agent with HTTP or shell tools could be tricked by a malicious prompt into contacting the metadata endpoint at 169.254.169.254."},{"source_index":0,"quote":"The execution role Zenity examined was not restricted to the compromised agent. Its permissions extended across AgentCore resources within the account and region, turning credential theft into a broader compromise."},{"source_index":0,"quote":"The research, named AgentCorruption, connected prompt injection, metadata access, and excessive execution-role permissions."},{"source_index":0,"quote":"AWS subsequently reported that newly deployed agents used IMDSv2 beginning February 14, 2026. Researchers observed substantial restrictions to the default execution role during their September 29 review."}],"impact.severity":[{"source_index":0,"quote":"The execution role Zenity examined was not restricted to the compromised agent. Its permissions extended across AgentCore resources within the account and region, turning credential theft into a broader compromise."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-10"}]},"notes_on_gaps":"No source states event.date_occurred, event.date_detected, event.duration, event.time_to_contain, event.operations_paused, event.precursor_events, event.near_miss, impact.direct_loss_usd, impact.records_exposed, impact.third_parties_affected_count, impact.reversibility, impact.downstream_exposure_count, context.org_size_band, context.country, context.denominator, context.regulatory, context.coverage, system.model_name, system.model_version, system.autonomy_level, system.guardrails_present, system.safeguard_state, system.intended_use, or context.incident_evidence. system.tier and event.date_disclosed are derived by rule and not written. event.detection_method is classified public_researcher from the research being named as the discovery; no source states the first signal. event.root_cause is integration because the execution role's permissions were not restricted to the compromised agent. impact.severity is major because the credentials reached other agents and stored conversation content in a live production environment with unbounded scope; no dollar figure is stated. system.deployment_context and lifecycle_stage are production because the attack chain targets exposed agents serving users. system.production_intended is true because the harness is a production AWS service. context.industry is classified from the cloud service context. context.systemic_exposure is true because one shared execution role and AgentCore component correlate loss across agents in the account and region. No source states a human approval or monitoring arrangement, so autonomy_level is unknown. event.root_cause: the stated reason names an absence, not a failed control: The execution role was not restricted to the compromised agent; its permissions extended across AgentCore resources within the account and region, turning credential theft into a broader compromise. system.tier: enterprise by rule (operator Amazon Web Services differs from developer Amazon). Sources disagree on event.failure_class_detail: [0] \"A malicious prompt tricked an agent with HTTP or shell tools into contacting the metadata endpoint, causing an SSRF that exposed execution-role credentials.\", [1] \"Researchers showed that an agent with HTTP or shell tools could be tricked by a malicious prompt into contacting the metadata endpoint at 169.254.169.254.\"; event.root_cause_detail: [0] \"The execution role was not restricted to the compromised agent; its permissions extended across AgentCore resources within the account and region, turning credential theft into a broader compromise.\", [1] \"The demonstrated blast radius depended on the permissions attached to the stolen identity.\"; impact.affected_description: [0] \"other agents in the same AWS account and region; internal agents; users and sessions; stored conversation content\", [1] \"other agents in the same AWS account and region; users and sessions; stored conversation content\". [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-10] system.lifecycle_stage: production. system.integration_type: agentic_with_tools. system.production_intended: classified from described behaviour. system.deployment_context: production. system.autonomy_level: no source states the arrangement. event.detection_method: public_researcher. event.summary: classified from described behaviour. context.industry: classified from described behaviour. context.denominator_available: no denominator is available for this incident. context.country: no source states the operator's location. [corrected by Srini Iyer, approved 2026-10-18 in the corrections review: severity reason printed the whole rubric]"},"context":{"industry":"Cloud computing","org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":true,"shared_model_id":"Amazon Bedrock AgentCore","upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"An exposed Amazon Bedrock AgentCore agent ran in a Firecracker microVM for AWS customers with HTTP or shell tools, invoked by a user with chat access. Its execution role carried broad permissions across AgentCore resources in the account and region.","quote":"Researchers showed that an agent with HTTP or shell tools could be tricked by a malicious prompt into contacting the metadata endpoint at 169.254.169.254.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"A malicious prompt tricked the agent into contacting the metadata endpoint 169.254.169.254, an SSRF that exposed its execution-role credentials. Because the role was not scoped to that agent, the theft breached least-privilege boundaries.","quote":"The resulting server-side request forgery exposed credentials associated with the agent’s execution role.","source_index":0,"grade":"C"},{"step":"reached","text":"The stolen credentials let attackers reach other agents’ container images and application code, internal agents, users, sessions and stored conversation content, and manipulate conversation history.","quote":"Broad Elastic Container Registry permissions then let them retrieve other agents’ container images and inspect application code.","source_index":0,"grade":"C"},{"step":"caught","text":"Zenity researchers discovered the attack chain, named AgentCorruption, connecting prompt injection, metadata access and excessive execution-role permissions.","quote":"The research, named AgentCorruption, connected prompt injection, metadata access, and excessive execution-role permissions.","source_index":0,"grade":"C"},{"step":"done","text":"AWS said newly deployed agents used IMDSv2 from February 14, 2026, and researchers saw substantial restrictions to the default execution role by their September 29 review. AWS recommends least-privilege execution roles.","quote":"AWS subsequently reported that newly deployed agents used IMDSv2 beginning February 14, 2026.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-10","source_urls":["https://cyberpress.org/aws-bedrock-agentcore-flaw-2/","https://cyberpress.org/aws-bedrock-agentcore-flaw-2/?amp=1"]}}