Zenity says one prompt took over every AgentCore agent in an AWS account

Correction, 8 October 2026

An earlier version of this article’s headline said researchers took over every AWS AgentCore agent in a region. The research covered agents within a single AWS account and region, and the headline stated the researchers’ claim as fact. We have corrected the headline and added a statement from AWS, which says the behaviour described is documented and is not a vulnerability.

Researchers at Zenity Labs say a single prompt to one public-facing AI agent let them take over every other agent in the same AWS account and region. The agents ran on Amazon Bedrock AgentCore. The security firm published the research on Thursday, alongside a talk at the SecTor 2026 conference in Toronto.

AgentCore is AWS’s managed service for building and running AI agents. Zenity calls the chain of issues AgentCorruption. It says its researchers could read private conversations, copy agents’ source code and steal stored credentials. They could also plant memories that changed how agents behaved.

“Cloud security is all about segmentation and least-privilege access. AI agents, however, need their creative space to be useful. Mixing the two creates an inherent conflict,” said Michael Bargury, Zenity’s co-founder and chief technology officer.

From one prompt to the whole account

The attack started with an agent that had a common tool able to make web requests. The researchers asked it, in plain language, to fetch data from the instance metadata service. This local AWS service hands temporary credentials to cloud workloads.

According to Zenity’s technical write-up, the virtual machines that run AgentCore agents did not block that traffic. The agent returned the credentials of its execution role, and the researchers then used them from their own computer. Zenity says it got the same result through other tools, including a shell tool.

The default role that AgentCore attached to agents covered resources across the whole account and region, Zenity says. With it, the researchers listed every agent in the account and region and downloaded each agent’s container image and source code. They also invoked internal agents they were never meant to reach.

The same role let them read users’ private conversations with any agent, according to Zenity. It also gave them API keys and other secrets stored in AWS Secrets Manager, including credentials agents used for services outside AWS.

Memory as a back door

Write access to agent memory made the takeover persistent, Zenity says. The researchers added a fake conversation event that AgentCore’s memory system stored as a lasting user instruction. It told the agent to visit a web page the researchers controlled before every answer and to follow what the page said.

By editing that page, they could change the agent’s instructions at any time without planting a new memory. In a video demonstration, a user kept chatting with an agent while it sent the conversation to the researchers’ server.

What AWS says

Zenity reported the metadata access to AWS on 25 December 2025 and the broad default role on 12 January 2026. In April, AWS closed the first report as “informative”, according to Zenity. AWS told Zenity that since 14 February, newly deployed AgentCore agents launch with IMDSv2 only. This version of the metadata service requires a session token for each request.

Zenity says the default role was still unchanged in June. On 29 September, during a final check before publication, it found that AWS had narrowed the role. The permissions to invoke other agents, read private conversations and access Secrets Manager were gone. Zenity’s disclosure includes no CVE identifier.

After this article was first published, AWS sent TNW the following statement.

“AWS is aware of the research published about Amazon Bedrock AgentCore, which inaccurately paints expected and documented behavior as a vulnerability. An agent can access resources in another AWS account only if the developer explicitly grants permissions on both the agent’s execution role and the target resource. As a best practice, we recommend that customers grant their execution roles only the permissions their agents need. For more information, see IAM permissions for AgentCore Runtime, Security best practices for AgentCore Runtime, and Security best practices in IAM. For more information on how credentials are managed, see Credentials management in AgentCore,” an AWS spokesperson said.

Zenity raised a $125m Series C round in August. The same month, its researchers found malicious AI skills with 1.7 million installs. In September, OpenAI’s agents became available to run entirely inside Amazon’s cloud.