Zenity Labs demonstrated an attack chain in Amazon Bedrock AgentCore that began with a prompt to a public-facing agent and expanded into access to other agents, private conversations and cloud credentials within the same account and region.
The researchers used a tool capable of outbound requests to reach the instance metadata service and retrieve temporary credentials. They said an overprivileged default role then enabled broader discovery and access, including source code, memories and secrets. The team also showed persistent manipulation through malicious agent memories.
AWS said access to an agent’s own execution-role credentials through metadata is documented and expected, and that cross-account access requires explicit permissions. The company recommends least-privilege execution roles. Zenity reported that AWS substantially restricted default permissions before publication.
The dispute does not change the defensive lesson. Public-facing agents, their tools, cloud roles and memory stores form one security boundary. Enterprises should restrict outbound requests, minimize IAM permissions, isolate agents by function and treat stored memory as security-sensitive data.
