Vulnerability / research

AgentCorruption demonstrates broad AgentCore permissions risk

Reported

What happened

Zenity demonstrated a prompt-driven route from a public AgentCore agent to credentials and other agents' resources within the same AWS account and region.

Parties and reporting

AI tools and systems: Amazon Bedrock AgentCore, AWS IAM

Outcome

AWS tightened defaults; the vendor disputes the vulnerability characterization and emphasizes customer permission configuration.

Operating lesson

Give each agent a narrowly scoped execution role and constrain access to metadata credentials and other agents' resources.

Evidence and limits

Presented publicly October 7; technical report followed October 8. Controlled same-account demonstration. AWS disputes classification; no confirmed malicious exploitation.

Sources