2026-04-07 · 2026-Q2
AWS Bedrock AgentCore "Agent God Mode" Cross-Agent Memory Access
PrimaryL1CredentialSecondaryL6Identity / Run
- Fixable:
- Yes, vendor patch
- Vendor response:
- Unknown
- In the wild:
- No
- Actor:
- Attacker
Target
AWS Bedrock AgentCore starter toolkit
Impact
Default IAM roles auto-created by the toolkit scope permissions to wildcard, letting any agent read or poison memory belonging to every other agent in the AWS account; enables privilege escalation and cross-tenant data exfiltration
Root Cause
Starter toolkit auto-create logic issues IAM policies with GetMemory and RetrieveMemoryRecords on resource "*" instead of per-resource scoping