Cases › security breach › LR-2026-0153
AgentCorruption: prompt-injected Bedrock AgentCore agent exfiltrates execution-role credentials via IMDS
Whose AI: Amazonsecurity breach
Severity major: The stolen execution-role credentials gave access across AgentCore resources in the account and region, including internal agents and stored conversation content, a live production compromise with unbounded scope.
Earliest source we hold 2026-10-10
An exposed Amazon Bedrock AgentCore agent with HTTP or shell tools, running in a Firecracker microVM, was tricked by a malicious prompt into contacting the metadata endpoint 169.254.169.254, an SSRF that exposed its execution-role credentials. The role was not scoped to that agent, so attackers used the credentials to reach other agents, internal agents, users, sessions and stored conversation content. Zenity researchers discovered and named the chain AgentCorruption. AWS said newly deployed agents used IMDSv2 from February 14, 2026, and researchers saw substantial restrictions to the default execution role by their September 29 review.
Risk grouping: AI attacked
| Who caused it | A person or organisation “Researchers showed that an agent with HTTP or shell tools could be tricked by a malicious prompt into contacting the metadata endpoint at 169.254.169.254.” source |
|---|---|
| Intended or not | Intended “A newly disclosed attack chain in Amazon Bedrock AgentCore lets attackers with chat access to an exposed AI agent steal temporary cloud credentials and compromise other agents in the same AWS account and region.” source |
| Before or after release | After release “A newly disclosed attack chain in Amazon Bedrock AgentCore lets attackers with chat access to an exposed AI agent steal temporary cloud credentials and compromise other agents in the same AWS account and region.” source |
| The AI's part | Attacked “Researchers showed that an agent with HTTP or shell tools could be tricked by a malicious prompt into contacting the metadata endpoint at 169.254.169.254.” source |
The story
1 · What it was doingAn exposed Amazon Bedrock AgentCore agent ran in a Firecracker microVM for AWS customers with HTTP or shell tools, invoked by a user with chat access. Its execution role carried broad permissions across AgentCore resources in the account and region.
2 · What went wrongA malicious prompt tricked the agent into contacting the metadata endpoint 169.254.169.254, an SSRF that exposed its execution-role credentials. Because the role was not scoped to that agent, the theft breached least-privilege boundaries.
3 · What it reached or didThe stolen credentials let attackers reach other agents’ container images and application code, internal agents, users, sessions and stored conversation content, and manipulate conversation history.
4 · How it was caughtZenity researchers discovered the attack chain, named AgentCorruption, connecting prompt injection, metadata access and excessive execution-role permissions.
5 · What was doneAWS said newly deployed agents used IMDSv2 from February 14, 2026, and researchers saw substantial restrictions to the default execution role by their September 29 review. AWS recommends least-privilege execution roles.
What the sources state
- What set it off hidden instructions in its input
Others like this
Show every field, with its source and grade
The AI system
Developer
Amazon
C one secondary source states it
Software around the model
Amazon Bedrock AgentCore
C one secondary source states it
Tools it was given
HTTP, shell
C one secondary source states it
What it was allowed to do
The execution role Zenity examined was not restricted to the compromised agent. Its permissions extended across AgentCore resources within the account and region, turning credential theft into a broader compromise.
C one secondary source states it
Stage of use
in live use
D inferred by us from the described behaviour, reason shown
Whose system
company using AI
D inferred by us from the described behaviour, reason shown
How it was connected
agentic with tools
D inferred by us from the described behaviour, reason shown
Meant for live use
yes
D inferred by us from the described behaviour, reason shown
What happened
Earliest source we hold
2026-10-10
A the date the source itself carries
What set it off
hidden instructions in its input
C one secondary source states it
Who caught it
an independent researcher or journalist
D inferred by us from the described behaviour, reason shown
Themes
prompt injection, SSRF, credential theft, cloud, agent, memory poisoning
C one secondary source states it
Who caused it
an outside attacker
C one secondary source states it
Where its input came from
a malicious prompt
C one secondary source states it
What was done
AWS subsequently reported that newly deployed agents used IMDSv2 beginning February 14, 2026. Researchers observed substantial restrictions to the default execution role during their September 29 review.
C one secondary source states it
What went wrong
security breach
C one secondary source states it
AI agent
an AI agent acted
C one secondary source states it
What it did
A malicious prompt tricked an agent with HTTP or shell tools into contacting the metadata endpoint, causing an SSRF that exposed execution-role credentials.
C one secondary source states it
Impact
Severity
major
D inferred by us from the described behaviour, reason shown
Kind of harm
others' security, privacy, operations
C one secondary source states it
Who was affected
other agents in the same AWS account and region; internal agents; users and sessions; stored conversation content
C one secondary source states it
Kinds of data exposed
credentials, conversation content
C one secondary source states it
Why this severity
The stolen execution-role credentials gave access across AgentCore resources in the account and region, including internal agents and stored conversation content, a live production compromise with unbounded scope.
D inferred by us from the described behaviour, reason shown
Context
Industry
Cloud computing
D inferred by us from the described behaviour, reason shown
Shared exposure
one shared model or part put many users at risk
C one secondary source states it
LR-2026-0153 · version 3 · published 2026-10-25 after automatic checks; not yet checked field by field by a person · changes to this case · JSON