"AgentCorruption": One Prompt to an Amazon Bedrock AgentCore Agent Yields Credentials for Every Agent in the Account and Region

Amazon Bedrock AgentCore runtime (Firecracker MicroVM) and its default execution role

Zenity Labs showed that chat access to a single exposed AgentCore agent was enough to trigger SSRF against the Instance Metadata Service (IMDSv1 until February 14, 2026) and obtain the agent's IAM role credentials. Because the default role covered all AgentCore resources in the region, those credentials could invoke other agents, read their conversations, plant persistent memories, pull secrets from Secrets Manager, and fetch container images. Zenity disclosed in December 2025; AWS closed the report as "informative" on April 12, 2026, the excessive permissions were still present on June 22, and Zenity found them addressed by September 29. AWS said the research "misrepresents documented behavior as a vulnerability." The attack did not cross account boundaries

Insufficient network isolation between the agent sandbox and instance metadata, plus a default execution role scoped to every agent in the region rather than one