AgentCorruption Puts AWS Bedrock AgentCore Environments at Risk With a Single Prompt

AgentCorruption Puts AWS Bedrock AgentCore Environments at Risk With a Single Prompt

AI agents are being deployed at speed, but the rush to connect them to cloud resources is creating dangerous permission gaps. Research from Zenity Labs shows how a single malicious prompt sent to a publicly accessible AWS Bedrock AgentCore agent could be enough to take control of every AgentCore agent in the same AWS account and region.

The AgentCorruption Chain

Zenity Labs discovered a chain of flaws in Amazon Bedrock AgentCore that it dubbed "AgentCorruption". The core issue is a clash between how AI agents operate and how cloud infrastructure is supposed to enforce least privilege. An attacker who only has chat access to one public-facing agent can exploit that access to pivot across the entire AgentCore deployment.

At the heart of the attack is access to Amazon EC2 Instance Metadata Service (IMDS). Bedrock AgentCore runs agents inside Firecracker MicroVMs. Zenity found that these MicroVMs did not enforce proper network isolation from IMDS, allowing an agent with HTTP request capability to query the instance metadata endpoint. Doing so returns temporary AWS credentials tied to the instance's IAM role.

This is not a new class of issue. The 2019 Capital One breach exploited Server-Side Request Forgery (SSRF) to reach IMDS and steal credentials. The difference with AgentCorruption is the entry point: instead of exploiting an SSRF in a web app, an attacker manipulates an AI agent's tool use to make the HTTP call.

From One Agent to Total Takeover

Once the temporary credentials are obtained, the blast radius becomes the critical factor. Zenity found that the default AgentCore IAM role granted far broader permissions than needed for a single agent. With those credentials, an attacker could:

• Pivot between agents: Invoke other AgentCore agents in the same account and region.
• Access private data: Read private conversations and agent sessions.
• Steal secrets: Access credentials and other secrets stored in AWS Secrets Manager.
• Poison agent memory: Manipulate stored context to persist control or misdirect future behavior.

In practice, a single prompt delivered to an overprivileged, internet-exposed agent was sufficient to traverse this chain. The autonomy that makes agents useful — their ability to reason, plan, and call tools — becomes the very mechanism that executes the attack once prompted.

AWS Response

Amazon addressed the findings after disclosure. Key fixes included:

• Enforcing IMDSv2: All new agents deployed on Bedrock AgentCore now require IMDSv2, which uses token-based authentication instead of the unauthenticated IMDSv1 style queries.
• Tightening the default role: AWS removed the overly broad permissions that allowed cross-agent invocation, reading private conversations, and accessing Secrets Manager from the default AgentCore execution role.

Existing deployments should not assume they are safe. Organizations that deployed AgentCore before these changes need to review and harden their configurations.

Mitigations for Organizations

The AgentCorruption case reinforces long-standing cloud security principles, now applied to agentic systems:

• Apply least privilege: Grant each agent only the permissions it absolutely needs. Never rely on a broad, shared default role for agents with different purposes.
• Treat agents as untrusted users: If an agent can be reached publicly or by untrusted input, assume it can be coerced. Validate tool calls and constrain what endpoints it can reach.
• Block IMDS access where not needed: Restrict agents from reaching 169.254.169.254. IMDSv2 is a necessary hardening, but network-level controls and egress restrictions reduce blast radius.
• Harden agent interfaces: Public chat interfaces to powerful agents should be treated as high-risk attack surfaces with rate limits, input filtering, and strong guardrails.
• Audit continuously: Review agent permissions, connected secrets, and cross-agent invocation paths. Monitor for unusual tool use, especially HTTP calls to metadata endpoints.

Key Takeaway

AgentCorruption is a reminder that connecting autonomous agents to cloud infrastructure without strict scoping is unsafe. The fix is not to remove agent capabilities, but to enforce the same isolation and least privilege that would apply to any service or workload. With agents acting on natural language prompts, a single sentence can become a remote action — so every permission must be justified.

Sources

• Dark Reading: 'AgentCorruption' Puts AWS Environments At Risk With Single Prompt
• Zenity Labs: AgentCorruption: How A Single Prompt Collapsed The Entire Cloud Security Model