{"schema_version":"0.10.0","id":"LR-2026-0800","record_version":1,"title":"Public-facing AWS agent could read, rewrite or delete other agents in its region (Amazon Bedrock AgentCore)","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":51.0,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":7.36,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: The Decoder · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: The Decoder · subject to change"}]},"sources_hash":"35ea4ee6a1236d5dc09e19cd3982618006feee8c0043bf70e657d5a7a0ef594c"},"system":{"model_name":null,"model_version":null,"developer":"Amazon Web Services","harness":"Strands","tools_granted":["web tool"],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"running enterprise AI agents with tools, memory, and access management","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-09","incident_class":"security_compromise","failure_class":"injection_triggered","agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"public_researcher","summary":"Amazon Bedrock AgentCore is AWS' platform for running enterprise AI agents with tools, memory, and access management. Security firm Zenity Labs reported that a chain of vulnerabilities let an attacker with chat access to one public-facing agent reach the other AgentCore agents in the same AWS account and region. The researchers said agents lacked proper isolation and handed over internal AWS credentials when asked, and default permissions applied across every agent in the region. Zenity says it reported the findings to AWS on December 25, 2025, after which AWS made IMDSv2 the default for new deployments. AWS also changed the default execution role, though the researchers still recommend stricter custom roles. AWS disputes that the behaviour was a vulnerability.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":"misconfigurations and insecure defaults in the AgentCore platform","failure_class_detail":"agent followed plain-language requests to query the metadata service and send results to an external server","responsible_party":null,"adversarial_actor":null,"input_provenance":"a single chat message sent to one public-facing agent","time_to_contain":null,"operations_paused":null,"remediation":"partial fix: harder metadata retrieval for new agents and tighter default execution role","precursor_events":null,"primary_risk":"RK08","secondary_risks":["RK03","RK05"],"remediations":[{"by":null,"kind":"fix","date_reported":null,"controls_added":["A3"],"quote":"Zenity says it reported the AgentCore findings to AWS on December 25, 2025, after which AWS made IMDSv2 the default for new AgentCore deployments.","source_index":0,"reviewed":false},{"by":null,"kind":"fix","date_reported":null,"controls_added":["A1"],"quote":"According to Zenity's updated account, AWS also changed AgentCore's default execution role around August.","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"moderate test: data of others touched (private conversations, source code, stored credentials) with bounded scope of the same AWS account and region","harm_class":["privacy","third_party_security"],"affected_description":"agents in the same AWS account and region","protected_class_involved":null,"data_categories_exposed":["private conversations","source code","stored credentials"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://the-decoder.com/a-single-prompt-was-enough-to-hijack-every-ai-agent-in-an-aws-account-zenity-researchers-found/","publisher":"The Decoder","date":"2026-10-09","type":"press","title":"One public-facing AI agent on AWS could read, rewrite, and delete every other agent in the region - The Decoder","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.developer":"C","system.intended_use":"C","system.harness":"C","system.tools_granted":"C","event.incident_class":"C","event.agent_involved":"C","event.failure_class":"C","event.failure_class_detail":"C","event.detection_method":"C","event.root_cause_detail":"C","event.input_provenance":"C","event.remediation":"C","impact.harm_class":"C","impact.data_categories_exposed":"C","impact.affected_description":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.remediations":"C","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"Amazon Bedrock AgentCore is AWS' platform for running enterprise AI agents with tools, memory, and access management."}],"system.intended_use":[{"source_index":0,"quote":"Amazon Bedrock AgentCore is AWS' platform for running enterprise AI agents with tools, memory, and access management."}],"system.harness":[{"source_index":0,"quote":"The researchers built a test agent using Strands, an open-source framework from AWS that ships with a web tool."}],"system.tools_granted":[{"source_index":0,"quote":"The researchers built a test agent using Strands, an open-source framework from AWS that ships with a web tool."}],"event.incident_class":[{"source_index":0,"quote":"A chain of vulnerabilities in Amazon's Bedrock AgentCore platform let researchers take over all of a company's AI agents in the same AWS region through a single chat message to one public agent."}],"event.agent_involved":[{"source_index":0,"quote":"When asked in plain language to query the metadata service and send the results to an external server, the agent followed the instructions."}],"event.failure_class":[{"source_index":0,"quote":"When asked in plain language to query the metadata service and send the results to an external server, the agent followed the instructions."}],"event.failure_class_detail":[{"source_index":0,"quote":"When asked in plain language to query the metadata service and send the results to an external server, the agent followed the instructions."}],"event.detection_method":[{"source_index":0,"quote":"Researchers at Zenity Labs say a single publicly accessible AI agent on Amazon's Bedrock AgentCore was enough to take over every AgentCore agent in the same AWS account and region."}],"event.root_cause_detail":[{"source_index":0,"quote":"Zenity would like to thank AWS for working together to fix the misconfigurations and insecure defaults that led to AgentCore agents being vulnerable."}],"event.input_provenance":[{"source_index":0,"quote":"A chain of vulnerabilities in Amazon's Bedrock AgentCore platform let researchers take over all of a company's AI agents in the same AWS region through a single chat message to one public agent."}],"event.remediation":[{"source_index":0,"quote":"AWS has partially fixed the issue by making it harder for new agents to retrieve internal metadata and by tightening the default execution role."}],"impact.harm_class":[{"source_index":0,"quote":"The researchers say a single prompt let them take over every AgentCore agent in the same AWS account and region, exposing private conversations, source code, and stored credentials."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"The researchers say a single prompt let them take over every AgentCore agent in the same AWS account and region, exposing private conversations, source code, and stored credentials."}],"impact.affected_description":[{"source_index":0,"quote":"The researchers say a single prompt let them take over every AgentCore agent in the same AWS account and region, exposing private conversations, source code, and stored credentials."}],"impact.severity":[{"source_index":0,"quote":"The researchers say a single prompt let them take over every AgentCore agent in the same AWS account and region, exposing private conversations, source code, and stored credentials."}],"impact.severity_because":[{"source_index":0,"quote":"The researchers say a single prompt let them take over every AgentCore agent in the same AWS account and region, exposing private conversations, source code, and stored credentials."}],"event.remediations":[{"source_index":0,"quote":"Zenity says it reported the AgentCore findings to AWS on December 25, 2025, after which AWS made IMDSv2 the default for new AgentCore deployments."},{"source_index":0,"quote":"According to Zenity's updated account, AWS also changed AgentCore's default execution role around August."}],"event.summary":[{"source_index":0,"quote":"Amazon Bedrock AgentCore is AWS' platform for running enterprise AI agents with tools, memory, and access management."},{"source_index":0,"quote":"An attacker needed only chat access to one public agent to exploit the flaws."},{"source_index":0,"quote":"Agents lacked proper isolation and handed over internal AWS credentials when asked."},{"source_index":0,"quote":"According to Zenity, they applied to every agent in the same account and region, granting read, write, and delete access that allowed destructive operations."},{"source_index":0,"quote":"Zenity says it reported the AgentCore findings to AWS on December 25, 2025, after which AWS made IMDSv2 the default for new AgentCore deployments."},{"source_index":0,"quote":"According to Zenity's updated account, AWS also changed AgentCore's default execution role around August."},{"source_index":0,"quote":"The researchers still recommend that companies manually assign their AI agents stricter roles with minimal access rights."}]},"notes_on_gaps":"Single source (The Decoder, press, reporting Zenity Labs research and AWS statements). The sources describe a research demonstration; no real-world exploitation or affected-party count is stated. No occurrence date or public disclosure date is stated, so date fields are omitted; the August change has no year. Model name, version, deployment context, lifecycle stage, autonomy level and guardrails are not stated. Trigger is omitted because the cause is not stated as a category. AWS disputes that the behaviour was a vulnerability and says it is documented behaviour, while Zenity says the account boundary was not crossed; these conflicting accounts are not resolved. Judgements made: detection_method set to public_researcher, root cause set to infrastructure from Zenity's wording, responsible party set to provider, failure_class set to injection_triggered because the agent followed plain-language instructions, severity set to moderate because the scope is bounded to one account and region and third-party data was touched, and the party_name for AgentCore controls set to Amazon Web Services. Controls E2 and C1 are not reported because the sources do not state whether they held or were missing. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: The Decoder · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"The system was AWS's AgentCore platform for running enterprise AI agents with tools, memory and access management.","quote":"Amazon Bedrock AgentCore is AWS' platform for running enterprise AI agents with tools, memory, and access management.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"Zenity says the agent could reach the instance metadata service because AgentCore lacked proper isolation.","quote":"An AI agent normally shouldn't be able to reach that service, but AgentCore lacked proper isolation, according to Zenity's technical blog post.","source_index":0,"grade":"C"},{"step":"reached","text":"Researchers say one prompt to a public agent let them reach every AgentCore agent in the same account and region.","quote":"The researchers say a single prompt let them take over every AgentCore agent in the same AWS account and region, exposing private conversations, source code, and stored credentials.","source_index":0,"grade":"C"},{"step":"caught","text":"Zenity reported the findings to AWS on December 25, 2025.","quote":"Zenity says it reported the AgentCore findings to AWS on December 25, 2025, after which AWS made IMDSv2 the default for new AgentCore deployments.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://the-decoder.com/a-single-prompt-was-enough-to-hijack-every-ai-agent-in-an-aws-account-zenity-researchers-found/"]},"analysis":{"sections":{"timeline":[{"text":"Zenity reported the AgentCore findings to AWS; AWS then made IMDSv2 the default for new AgentCore deployments.","quote":"Zenity says it reported the AgentCore findings to AWS on December 25, 2025, after which AWS made IMDSv2 the default for new AgentCore deployments.","source_index":0,"when":"2025-12-25"},{"text":"AWS changed AgentCore's default execution role.","quote":"According to Zenity's updated account, AWS also changed AgentCore's default execution role around August.","source_index":0,"when":"around August"},{"text":"AWS partially fixed the issue.","quote":"AWS has partially fixed the issue by making it harder for new agents to retrieve internal metadata and by tightening the default execution role.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://the-decoder.com/a-single-prompt-was-enough-to-hijack-every-ai-agent-in-an-aws-account-zenity-researchers-found/"]}}