Zenity Labs recently discovered a critical security flaw in Amazon Bedrock AgentCore, a service used for building AI agents within AWS. This vulnerability, dubbed AgentCorruption, allowed a single prompt to access sensitive data across all agents within the same AWS account and region. Exploiting this flaw, researchers gained access to private chats, source code, API keys, OAuth tokens, and secrets stored in AWS Secrets Manager.
Amazon Bedrock AgentCore operates within a Firecracker microVM, which is designed to provide temporary AWS credentials necessary for cloud workloads. By instructing an AI agent to connect to the local metadata endpoint, Zenity was able to retrieve these credentials, creating a server-side request forgery pathway through prompt injection. This did not require any software bug in the chat page; simply following user instructions with an allowed tool sufficed.
The risk extended further due to the default IAM role's broad permissions, which were not limited to individual agents. Researchers accessed agent IDs, pulled container images, invoked internal agents, and read session events using permissions like bedrock-agentcore:InvokeAgentRuntime and bedrock-agentcore:ListEvents. They also managed to create false memories and alter agent goals by accessing memory beyond single sessions.
Zenity reported the issue to AWS, which transitioned new deployments to IMDSv2 by February and removed permissions allowing broad agent calls and chat access by September. AWS, while acknowledging the issue, stated that the access pattern was expected and documented, emphasizing the importance of strict permission settings.
Security teams need to take additional precautions, as AWS recommends crafting custom roles with minimal permissions, blocking wildcard permissions, validating prompt input, limiting network access, and monitoring for unusual activity. The incident underscores the necessity of treating AI agents as cloud workloads and rigorously reviewing access permissions both before deployment and after any changes.
