One prompt could expose every AgentCore agent in an AWS account
Zenity found that an exposed AWS Bedrock AgentCore agent could yield temporary IAM credentials through a single prompt, letting an attacker take over every AgentCore agent in the same AWS account and region. The attack directs an HTTP-capable agent to AWS’s Instance Metadata Service, which returns credentials meant for the workload. Those credentials could expose private conversations, alter agent memories, and retrieve secrets, but AWS has patched the issues.