Researchers say one prompt to a public AWS AgentCore agent let them take over every agent in the same account and region

Zenity Labs has disclosed AgentCorruption, a chain of security flaws in Amazon Bedrock AgentCore, the AWS platform for running enterprise AI agents with tools, memory and access management. The researchers say a single prompt to one public-facing agent let them take over every AgentCore agent in the same AWS account and region. Zenity says the flaws were systemic and affected any agent with built-in tooling, across AWS accounts. The researchers reached internal agents they were not authorized to use, as well as private conversations, source code, long-term memories, API keys, OAuth tokens and other credentials stored in AWS Secrets Manager. They also planted malicious memories that told agents to send future conversations to an attacker-controlled destination. The Decoder reports that agents were not properly isolated, handed over internal AWS credentials when asked, and ran with broad default permissions that covered the whole region. According to The Decoder, AWS has partly fixed the problem by making it harder for new agents to retrieve internal metadata and by tightening the default execution role. The researchers still advise companies to give each agent a strict, least-privilege role themselves. Zenity presented the work at SecTor 2026 in Toronto. "Cloud security is all about segmentation and least-privilege access. AI agents, however, need their creative space to be useful," said Zenity CTO Michael Bargury.