A security vulnerability in Amazon Bedrock AgentCore, discovered by Zenity Labs researchers, could allow attackers to steal temporary credentials and access source code of AI agents. The vulnerability, which was present in earlier versions of AgentCore, could be exploited with a single prompt, with further coverage provided by The Register.
The vulnerability stemmed from AgentCore's use of IMDSv1, which exposed temporary credentials for the AI agents. An attacker could craft a prompt to trigger a server-side request forgery (SSRF) attack, obtaining these credentials. These credentials, due to an overpermissioned default IAM role, allowed the attacker to enumerate and access other agents within the same AWS account and region. This included the ability to pull agent container images from Amazon Elastic Container Registry (ECR) and inspect their source code. Furthermore, the stolen credentials enabled access to user sessions and agent conversations stored in memory. Zenity Labs disclosed the findings to AWS in December 2025, with AWS eventually updating AgentCore to exclusively use IMDSv2 by February 2026. However, the excessive permissions issue persisted until at least September 2026, when AWS finally addressed the remaining security concerns.
Source: The Register
