A security vulnerability in Amazon Bedrock AgentCore, discovered by Zenity Labs researchers, could allow attackers to steal temporary credentials and access source code of AI agents. The vulnerability, which was present in earlier versions of AgentCore, could be exploited with a single prompt, with further coverage provided by The Register.
The vulnerability stemmed from AgentCore's use of IMDSv1, which exposed temporary credentials for the AI agents. An attacker could craft a prompt to trigger a server-side request forgery (SSRF) attack, obtaining these credentials. These credentials, due to an overpermissioned default IAM role, allowed the attacker to enumerate and access other agents within the same AWS account and region. This included the ability to pull agent container images from Amazon Elastic Container Registry (ECR) and inspect their source code. Furthermore, the stolen credentials enabled access to user sessions and agent conversations stored in memory. Zenity Labs disclosed the findings to AWS in December 2025, with AWS eventually updating AgentCore to exclusively use IMDSv2 by February 2026. However, the excessive permissions issue persisted until at least September 2026, when AWS finally addressed the remaining security concerns.
On Oct. 13, a spokesperson for AWS provided the following statement to SC Media: “AWS is aware of the research published about Amazon Bedrock AgentCore, which inaccurately paints expected and documented behavior as a vulnerability. An agent can access resources in another AWS account only if the developer explicitly grants permissions on both the agent's execution role and the target resource. As a best practice, we recommend that customers grant their execution roles only the permissions their agents need. For more information, see IAM permissions for AgentCore Runtime, Security best practices for AgentCore Runtime, and Security best practices in IAM. For more information on how credentials are managed, see Credentials management in AgentCore.”
Source: The Register
