---
title: "[AUTO] AgentCorruption: Design failure in AWS Bedrock lets one prompt hijack a region"
pubDatetime: 2026-10-09T10:06:00.000Z
description: "AWS Bedrock AgentCore design flaw allowed a prompt to reach instance credentials and abuse an overprivileged execution role"
tags: [ai-security, vulnerability, aws, 2026, 2026-q4, 2026-10, AUTO]
---
AWS Bedrock's AgentCore let a tool-enabled agent reach the instance metadata service. A prompt could make it issue a server-side request forgery (SSRF), exposing temporary credentials for the agent's IAM role. Zenity Labs' [AgentCorruption research](https://labs.zenity.io/post/agentcorruption-how-a-single-prompt-collapsed-the-entire-cloud-security-model) traced the blast radius: the default role could enumerate other agents in the region, pull their container images, read private conversations, plant memories, and access AWS Secrets Manager.

Zenity published the research on 8 October 2026. That date is separate from its earlier private reports to AWS: the IMDS finding was disclosed in December 2025, followed by the overprivileged-role report on 12 January 2026. AWS said new AgentCore deployments had used IMDSv2 since 14 February. Zenity still found the broad role unchanged on 22 June. By 29 September, it observed AWS had substantially restricted that role, including permissions Zenity said enabled cross-agent access to conversations and secrets. [The Register's follow-up](https://www.theregister.com/security/2026/10/09/aws-agentcore-security-undone-by-prompt-requesting-credentials/5302436) lays out the same remediation timeline.

Separately, [BeyondTrust disclosed two RCE flaws](https://www.beyondtrust.com/blog/entry/amazon-bedrock-agentcore-python-sdk-rce-cves) in the Python SDK's `install_packages()` helper. Those are a different finding from AgentCorruption's metadata and role-permission chain.

---

*Sources: [Zenity Labs: AgentCorruption overview](https://labs.zenity.io/post/agentcorruption-how-a-single-prompt-collapsed-the-entire-cloud-security-model)  •  [AgentCorruption: Initial IMDS Access](https://labs.zenity.io/post/agentcorruption-initial-imds-access)  •  [AgentCorruption: One Role to Rule Them All](https://labs.zenity.io/post/agentcorruption-one-role-to-rule-them-all)  •  [CVE-2026-12530 Security Bulletin](https://aws.amazon.com/security/security-bulletins/2026-044-aws/)*

*Coverage: [AWS AgentCore security undone by prompt requesting credentials](https://www.theregister.com/security/2026/10/09/aws-agentcore-security-undone-by-prompt-requesting-credentials/5302436)  •  ['AgentCorruption' Puts AWS Environments At Risk With One Prompt](https://www.darkreading.com/cloud-security/agentcorruption-aws-environments-at-risk-single-prompt)  •  [Two RCE CVEs in the Amazon Bedrock AgentCore Python SDK Code Interpreter Helper](https://www.beyondtrust.com/blog/entry/amazon-bedrock-agentcore-python-sdk-rce-cves)*

*Related on this blog: [The Managed-Agent Landscape: Twelve Ways to Not Run Your Own Agent](/posts/managed-agents-landscape)  •  [SalesBleed: Salesforce Patched the Same Agentforce Hole Twice](/posts/salesbleed-agentforce-prompt-injection)  •  [[AUTO] How Kiro's Trust Boundaries Collapsed](/posts/auto-kiro-trust-boundary)*