AWS Bedrock Vulnerability Allowed Total AI Agent Hijacking via a Single Prompt

Security firm Zenity Labs disclosed an "AgentCorruption" vulnerability in Amazon Bedrock AgentCore that allowed attackers to hijack all agents in an AWS account and region using just chat access to a single public agent. Researchers successfully prompted a test agent to query the internal AWS Instance Metadata Service (169.254.169.254), exposing temporary credentials due to a lack of sandbox boundary isolation. AgentCore's default execution roles historically granted excessive permissions, allowing attackers to list every agent, download code packages in seconds, extract API keys, and read private conversations across the entire region. By tampering with long-term memory functions, attackers could plant instructions forcing an agent to silently forward all future user conversations to an external destination. AWS has since mandated IMDSv2 as the default for new deployments and significantly tightened default agent execution roles, removing region-wide invocation and credential extraction rights. "Cloud security is about segmentation and least-privilege access. But AI agents need freedom to be useful." — Michael Bargury