Zenity Labs shows one prompt could pull other agents' code out of Amazon Bedrock AgentCore
Zenity Labs researchers found that a single prompt could steal temporary credentials from Amazon Bedrock AgentCore through its IMDSv1 metadata service. SC World, citing The Register, says an excess-permissions problem outlasted AWS's metadata fix.
The Watch · Security desk
Timeline with three steps: December 2025, Zenity Labs discloses its AgentCore findings to AWS; February 2026, AWS has updated AgentCore to use only IMDSv2; September 2026, AWS addresses the excess-permissions issue that had persisted after the metadata fix.
| Date | Event | Claim |
|---|---|---|
| December 2025 | Zenity Labs discloses the AgentCore findings to AWS | 8 |
| February 2026 | AWS has AgentCore using IMDSv2 exclusively | 9 |
| September 2026 | AWS addresses the remaining excess-permissions concerns | 10 |
What happened
- An overpermissioned default IAM role let the stolen credentials enumerate and access other agents in the same AWS account and region.
- That access included pulling other agents' container images from Amazon ECR and inspecting their source code.
- The same credentials also reached user sessions and agent conversations held in memory.
- Zenity Labs disclosed the findings to AWS in December 2025, and AWS updated AgentCore to use only IMDSv2 by February 2026.
Why it matters
- Who's exposed exposure Customers on earlier AgentCore versions who ran several agents in one account and region had each agent's image, code and memory within reach of whichever agent took the prompt.
- What it limits constraint The February IMDSv2 update was not closure. The permissions issue stayed open after it, so the update alone did not limit what a credential holder could reach.
- Who has to decide decision The reach ended at the account and region boundary, so where a team places its agents sets how many of them share one exposure.
The two fixes did different jobs. Moving to IMDSv2 addressed the route the prompt used to obtain credentials [3][4][9]. The excess-permissions issue stayed after that change, and the default IAM role is what set the stolen credentials' reach [5][10].
Measured from Zenity Labs' December 2025 disclosure, the metadata change took about two months [13]. The permissions problem took about nine [14]. The brief gives months, not days, so both figures are approximate.
The brief is loose on the end date. It says the permissions issue persisted until at least September 2026, and in the same sentence says AWS addressed the remaining concerns then [10]. Those two statements do not fix a date. SC World credits The Register for the account [11], and the brief does not include a statement from AWS or from Zenity Labs.
Scope is bounded. The access reached other agents in the same AWS account and region [5], and the brief places the flaw in earlier versions of AgentCore [2]. The brief does not mention a CVE identifier or any exploitation in the wild [12]. The material describes a research finding on one product. It does not describe an attacker using it [1].
In our view the default role is the larger finding. A prompt was the trigger, but the role set the reach into container images, source code and session memory [5][6][7].
What to watch
- An AWS statement or documentation confirming when and how the default role's permissions were narrowed.
- A Zenity Labs technical write-up naming the affected AgentCore versions and whether a CVE identifier is assigned.
- Any report of this chain used against a real AgentCore deployment, which would move it from research finding to incident.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap−5
- Incentives
- Not scored
- Confidence50
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
A vulnerability in Amazon Bedrock AgentCore, discovered by Zenity Labs researchers, could allow attackers to steal temporary credentials and access the source code of AI agents.
- [2]
The vulnerability was present in earlier versions of AgentCore and could be exploited with a single prompt.
- [3]
The vulnerability stemmed from AgentCore's use of IMDSv1, which exposed temporary credentials for the AI agents.
- [4]
An attacker could craft a prompt to trigger a server-side request forgery (SSRF) attack, obtaining the credentials.
- [5]
Because of an overpermissioned default IAM role, the credentials allowed the attacker to enumerate and access other agents within the same AWS account and region.
- [6]
The access included pulling agent container images from Amazon Elastic Container Registry (ECR) and inspecting their source code.
- [7]
The stolen credentials enabled access to user sessions and agent conversations stored in memory.
- [8]
Zenity Labs disclosed the findings to AWS in December 2025.
- [9]
AWS updated AgentCore to exclusively use IMDSv2 by February 2026.
- [10]
The excessive permissions issue persisted until at least September 2026, when AWS finally addressed the remaining security concerns.
- [11]
The SC World brief credits The Register as the source of the account.
- [12]
The SC World brief does not mention a CVE identifier or any exploitation in the wild.
- [13]
From Zenity Labs' disclosure to AWS (December 2025) to the IMDSv2-only update (by February 2026) is about two months.
- [14]
From Zenity Labs' disclosure to AWS (December 2025) to the point AWS addressed the remaining permissions concerns (September 2026) is about nine months.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- scworld.comAmazon Bedrock agent vulnerability allowed credential theft and code access
1 article · October 11, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.