One prompt to one exposed AgentCore agent reached every agent in the region, Zenity Labs found
Zenity Labs showed that one prompt to one exposed Bedrock AgentCore agent could take over every AgentCore agent in the same AWS account and region. The reach came from a broad default execution role, and narrowing it is the step teams control.
The Engineer · Build desk
Timeline: IMDS access reported to AWS December 25, 2025; overprivileged-role report filed January 12, 2026; AWS closed IMDS report as informative April 2026; AWS confirmed substantial hardening of default execution role September 29, 2026; Zenity Labs published October 8, 2026.
| Date | Event | Claim |
|---|---|---|
| December 25, 2025 | IMDS access reported to AWS | 11 |
| January 12, 2026 | Overprivileged-role report filed | 12 |
| April 2026 | AWS closes IMDS report as "informative" | 11 |
| September 29, 2026 | AWS confirms substantial hardening of default execution role | 12 |
| October 8, 2026 | Zenity Labs publishes the research | 1 |
What happened
- Zenity Labs published the research on October 8, 2026 and presented it at the SecTor 2026 conference.
- AgentCore runs each agent in a microVM that did not isolate network traffic like a normal compute instance, so an agent could reach the metadata service at 169.254.169.254.
- The default IAM role on AgentCore workloads was not scoped to one agent. It carried broad permissions across every AgentCore resource in the account's region.
- The metadata access was reported to AWS on December 25, 2025. AWS closed it as "informative" in April 2026 after moving newly deployed agents to IMDSv2.
Why it matters
- Who has to decide decision Teams with agents deployed before late September 2026 have to check the attached role themselves. AWS changed the default only for newly created roles and does not rewrite ones already attached.
- Who's exposed exposure A stolen role can also read private conversations across all agents and users and plant memories that leave a trusted enterprise agent running under attacker-controlled instructions.
- What doesn't add up contradiction AWS's public position is that the behavior is "documented and expected", yet it hardened the default role. Until an older role is replaced, scoping stays the customer's job.
The attack is two ordinary flaws that multiply, according to a dev.to write-up of the Zenity research. If a tool lets the agent send HTTP requests, that tool works as a server-side request forgery primitive [4]. The request originates inside the instance, so the metadata service answers it with short-lived IAM credentials belonging to the agent's role [4]. One well-crafted prompt was enough to get the agent to retrieve those credentials and return them [14].
The role then decides what the credentials are worth. In the write-up, the holder could list every other agent's ID through DescribeLogGroups across the region [6], invoke any of them with bedrock-agentcore:InvokeAgentRuntime [7], and pull secrets with secretsmanager:GetSecretValue and bedrock-agentcore:GetResourceApiKey [10]. Each step used an action the default role already granted.
The role report was filed and the hardening confirmed 260 days apart [16].
For a region-wide takeover to transfer to your account, three things have to hold. You need an agent with a tool that can make HTTP requests. An outsider needs a way to put text in front of it. And the agent needs the old broad role. The post notes that an agent can be redirected by content it fetches from the web, a document, or another agent [15]. In our view that makes "exposed" wider than a public chat endpoint.
The audit is two commands, each with --role-name set to the execution role: aws iam list-attached-role-policies and aws iam list-role-policies [13]. Compare the output with the actions above. AWS's own advice, as the post relays it, is to grant execution roles only the permissions the agent needs [18]. The post's text ends before its narrowing steps, and it does not say whether earlier deployments also moved to IMDSv2.
What to watch
- Zenity Labs' own write-up and SecTor 2026 talk, for the exact policy statements, to check this account against the primary source.
- Any AWS documentation or notice on whether roles attached before September 29, 2026 get flagged or rewritten.
- Whether AWS states that agents deployed before the IMDSv2 change were also moved.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence48
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Zenity Labs published the AgentCore research on October 8, 2026 and presented it at the SecTor 2026 conference.
- [2]
A single chat prompt to one exposed agent was enough to take over every Bedrock AgentCore agent in the same AWS account and region.
- [3]
AgentCore runs each agent in a lightweight microVM that did not isolate network traffic the way a normal compute instance does, so an agent could reach the instance metadata service at 169.254.169.254.
- [4]
Any agent tool that can make an HTTP request becomes a server-side request forgery primitive: the request originates from inside the instance, so IMDS answers it with the temporary IAM credentials for the agent's own role.
- [5]
The default IAM role attached to AgentCore workloads was overprivileged: it was not scoped to a single agent and carried broad permissions across every AgentCore resource in the account's region.
- [6]
The role allowed DescribeLogGroups across the region, letting the holder discover every other agent's ID.
- [7]
The role allowed bedrock-agentcore:InvokeAgentRuntime, so any agent in the region could be invoked, opening lateral movement to internal agents.
- [8]
The role allowed bedrock-agentcore:ListEvents, so every private conversation across all agents and users could be read.
- [9]
The role allowed bedrock-agentcore:CreateEvent on BedrockAgentCoreMemory, so planted memories could permanently change another agent's behavior and leave a trusted enterprise agent running under attacker-controlled instructions.
- [10]
The role allowed secretsmanager:GetSecretValue and bedrock-agentcore:GetResourceApiKey, so credentials AgentCore was meant to keep away from the agent could be pulled.
- [11]
The IMDS access was reported to AWS on December 25, 2025; AWS closed it as "informative" in April 2026 after moving newly deployed agents to IMDSv2.
- [12]
The overprivileged-role report was filed January 12, 2026; AWS confirmed substantial hardening of the default execution role on September 29, 2026.
- [13]
The post's audit uses two commands, aws iam list-attached-role-policies and aws iam list-role-policies, each with --role-name set to the AgentCore execution role.
- [14]
A carefully written prompt was all it took to make the agent fetch the IMDS credentials and hand them back.
- [15]
An agent holds a session, calls tools, and can be redirected by content it fetches from the web, from a document, or from another agent.
- [16]
260 days passed between the overprivileged-role report on January 12, 2026 and AWS's confirmed hardening on September 29, 2026.
- [17]
AWS's public position is that the behavior is "documented and expected": an agent can reach resources in another account only if the developer explicitly grants permissions on both sides.
- [18]
AWS's recommendation is to grant execution roles only the permissions the agent needs.
- [19]
AWS's September 2026 hardening changed the default for newly created roles; agents deployed before that date may still carry the old broad role because AWS does not retroactively rewrite a role already attached.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- dev.toOne prompt shouldn't own your cloud: scoping AWS Bedrock AgentCore credentials
1 article · October 15, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- AI Agent SecurityFollow
- Server-Side Request ForgeryFollow
- Cloud IAM Least PrivilegeFollow
- Prompt injectionFollow
Entities
- AWS Bedrock AgentCoreFollow
- Amazon Web ServicesFollow
- SecTorFollow
- AWS Instance Metadata ServiceFollow
- Zenity LabsFollow