AI Risk Wire

Cases › security breach › LR-2026-0800

Public-facing AWS agent could read, rewrite or delete other agents in its region (Amazon Bedrock AgentCore)

Preliminary Why: 1 report: The Decoder · subject to change · 1 independent report

Status: fix reported

Severity moderate
Reported 9 Oct 2026
Developer and model Amazon Web Services
Agent tool Strands
Could do web tool

No source states: loss or records, deployer, industry.

Severity moderate: test: data of others touched (private conversations, source code, stored credentials) with bounded scope of the same AWS account and region

Amazon Bedrock AgentCore is AWS' platform for running enterprise AI agents with tools, memory, and access management. Security firm Zenity Labs reported that a chain of vulnerabilities let an attacker with chat access to one public-facing agent reach the other AgentCore agents in the same AWS account and region. The researchers said agents lacked proper isolation and handed over internal AWS credentials when asked, and default permissions applied across every agent in the region. Zenity says it reported the findings to AWS on December 25, 2025, after which AWS made IMDSv2 the default for new deployments. AWS also changed the default execution role, though the researchers still recommend stricter custom roles. AWS disputes that the behaviour was a vulnerability.

What happened

1 · What it was doingThe system was AWS's AgentCore platform for running enterprise AI agents with tools, memory and access management.
2 · What went wrongZenity says the agent could reach the instance metadata service because AgentCore lacked proper isolation.
3 · What it reached or didResearchers say one prompt to a public agent let them reach every AgentCore agent in the same account and region.
4 · How it was caughtZenity reported the findings to AWS on December 25, 2025.

What was done

Fix reported

“Zenity says it reported the AgentCore findings to AWS on December 25, 2025, after which AWS made IMDSv2 the default for new AgentCore deployments.”

Short-lived, scoped credentials

No later incident for Amazon Web Services under this risk on record.

Risks

AI system attacked or breached
Primary23 incidents
Credential and privilege abuse
Also37 incidents
Agent escapes its sandbox
Also19 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Application

Vulnerability scanning of AI components · Adversarial testing before deployment · Short-lived, scoped credentials · Live behaviour monitoring · AI incident response plan · Segmentation of agent components · Encryption of stored data

Infrastructure / target

Known flaws patched · Intrusion and endpoint detection · Inventory of exposed services

Similar incidents

AgentCorruption: prompt-injected Bedrock AgentCore agent exfiltrates execution-role credentials via IMDS2026-10-10
Hidden web text hijacks AWS Kiro IDE to run attacker code2026-07-21
Amazon Q Developer VS Code extension shipped an injected prompt instructing the agent to wipe files and AWS resources2025-07-23
Amazon's Kiro agent reportedly deleted and recreated an environment, contributing to a 13-hour AWS Cost Explorer outage2026-02-20

All cases of this kind ›

Evidence

No source states: when it happened, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Show the full account: 3 items from the primary sources

What happened, in order

  1. 2025-12-25 Zenity reported the AgentCore findings to AWS; AWS then made IMDSv2 the default for new AgentCore deployments.
  2. around August AWS changed AgentCore's default execution role.

Not dated in the sources:

  • AWS partially fixed the issue.
Show every field, with its source and grade

The AI system

Developer
Amazon Web Services
C one secondary source states it
Software around the model
Strands
C one secondary source states it
Tools it was given
web tool
C one secondary source states it
What it was for
running enterprise AI agents with tools, memory, and access management
C one secondary source states it

What happened

Earliest source we hold
2026-10-09
D inferred by us from the described behaviour, reason shown
Who caught it
an independent researcher or journalist
C one secondary source states it
Cause in detail
misconfigurations and insecure defaults in the AgentCore platform
C one secondary source states it
Where its input came from
a single chat message sent to one public-facing agent
C one secondary source states it
What was done
partial fix: harder metadata retrieval for new agents and tighter default execution role
C one secondary source states it
What went wrong
security breach
C one secondary source states it
AI agent
an AI agent acted
C one secondary source states it
What it did
agent followed plain-language requests to query the metadata service and send results to an external server
C one secondary source states it
primary risk
RK08
D inferred by us from the described behaviour, reason shown
secondary risks
RK03, RK05
D inferred by us from the described behaviour, reason shown
remediations
kind: fix; controls added: A3; quote: Zenity says it reported the AgentCore findings to AWS on December 25, 2025, after which AWS made IMDSv2 the default for new AgentCore deployments.; source index: 0, kind: fix; controls added: A1; quote: According to Zenity's updated account, AWS also changed AgentCore's default execution role around August.; source index: 0
C one secondary source states it

Impact

Severity
moderate
D inferred by us from the described behaviour, reason shown
Kind of harm
privacy, others' security
C one secondary source states it
Who was affected
agents in the same AWS account and region
C one secondary source states it
Kinds of data exposed
private conversations, source code, stored credentials
C one secondary source states it
Why this severity
test: data of others touched (private conversations, source code, stored credentials) with bounded scope of the same AWS account and region
D inferred by us from the described behaviour, reason shown

Notes on gaps

The sources describe a research demonstration; no real-world exploitation or affected-party count is stated. AWS disputes that the behaviour was a vulnerability and says it is documented behaviour, while Zenity says the account boundary was not crossed; these conflicting accounts are not resolved. Controls E2 and C1 are not reported because the sources do not state whether they held or were missing.

LR-2026-0800 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON