What happened

Researchers at Zenity Labs found that an AI agent running on Amazon Bedrock AgentCore could be tricked by a single chat prompt into fetching its own temporary AWS credentials from the instance metadata service. With those credentials, an attacker could take over every AgentCore agent in the same account and region.

Zenity reported the issue to AWS in December 2025. The excessive permissions were still in place in June 2026, and by late September AWS had addressed the problem.

Why it matters

AI agents are now part of the cloud attack surface. An agent with broad permissions that accepts outside input is effectively a public door into your AWS account, and prompt injection is the new way to open it.

How to protect your AWS environment

• Give every AI agent its own narrowly scoped IAM role, with no access to unrelated resources.
• Block agents from reaching the instance metadata service unless strictly required.
• Log and review the tools and API calls your agents make, just as you would for a human user.

Source: Click to Read the original report (The Register)