Researchers at Zenity Labs discovered a vulnerability in Amazon Bedrock AgentCore that allowed attackers to hijack AI agents. By exploiting a single publicly accessible agent, researchers could gain control over all agents within the same AWS account and region using a single prompt.
The flaw stemmed from a lack of proper isolation, which enabled agents to access the Instance Metadata Service at 169.254.169.254. This allowed the extraction of temporary credentials, which could then be used to impersonate instances and access sensitive data, including source code and stored API keys.
Zenity reported the findings to AWS on December 25, 2025. Following the report, AWS made IMDSv2 the default for AgentCore deployments to enhance security. Additionally, AWS updated the default execution role in August to restrict permissions that previously allowed agents to invoke others or access private data.
The researchers noted that the default permissions in AgentCore were overly broad, granting read, write, and delete rights across all agents in a region. This enabled attackers to pivot from public-facing agents to internal systems, tamper with long-term memory, and intercept private conversations.
Zenity has previously identified similar vulnerabilities in other platforms, including Salesforce Einstein, Copilot Studio, and Cursor. The firm emphasizes the tension between the need for AI agent autonomy and the security principles of segmentation and least-privilege access.
