One Prompt Hijacked Every AWS AI Agent in a Region

Researchers at Zenity Labs found a chain of security flaws in Amazon Bedrock AgentCore, AWS's platform for running enterprise AI agents with memory, tools, and access controls. The flaw — named AgentCorruption — means that a single chat message sent to one publicly accessible agent was enough to take over every AgentCore agent in the same AWS account and region ¹.

How the Attack Works

The problem starts with inadequate isolation between agents. AWS runs an Instance Metadata Service at the address 169.254.169.254, which hands out temporary credentials that let workloads authenticate with AWS services. Normally, an AI agent should not be able to reach this service, but AgentCore did not block it properly, according to Zenity's technical blog post ¹.

The researchers built a test agent using Strands, an open-source framework from AWS. When they asked the agent in plain language to query the metadata service and send the results to an external server, the agent followed the instructions. As the researchers wrote: "The sandbox boundary we were supposed to be fighting simply wasn't there" ¹.

The stolen credentials worked outside the platform, so the attackers no longer needed the agent to continue the attack ¹.

Default Permissions Exposed Everything

The second part of the attack was made possible by AgentCore's default permissions, which applied across the entire region rather than to just the agent receiving them. This meant read, write, and delete access for every agent in the same account and region ¹.

With those permissions, the researchers could list every agent, download their code packages in seconds, and invoke each one. Those packages often contain forgotten passwords or API keys alongside source code ¹. An attacker could move from a public-facing customer service agent to an internal finance agent and access its data. The researchers could also read all private conversations between users and agents .

For agents with long-term memory, the researchers could alter that memory to influence future behavior, planting instructions that made agents forward future conversations to an external destination without users noticing ¹.

AWS Has Partially Fixed the Issue

Zenity reported the findings to AWS on December 25, 2025. AWS subsequently made IMDSv2 — a more secure version of the metadata service — the default for new AgentCore deployments ². Around August, AWS also tightened the default execution role, removing the ability for agents to invoke other agents, read private conversations, or retrieve credentials from AWS Secrets Manager ¹.

However, the researchers still recommend that companies manually assign their AI agents stricter roles with minimal access rights, rather than relying on defaults ¹. The underlying lesson remains: even partial fixes are better than nothing, but defense in depth matters for platforms handling sensitive enterprise data ³.

Key facts

• A single prompt to one public agent gave attackers control over every AgentCore agent in the same AWS account and region
• The flaw exploited inadequate sandbox isolation, letting agents reach the internal metadata service at 169.254.169.254
• Default permissions applied across the entire region, granting read, write, and delete access to all agents
• AWS made IMDSv2 default and tightened execution roles, but recommends manual stricter role assignments
• The vulnerability was reported to AWS on December 25, 2025 and disclosed at SecTor 2026 on October 8

Sources

1. One public-facing AI agent on AWS could read, rewrite, and delete every other agent in the region — the-decoder.com
2. AgentCorruption: One Prompt Hijacked Every Bedrock AgentCore Agent — explainx.ai
3. Vulnerability in AWS Bedrock AgentCore Exposes AI Agents to Hijacking — threatcluster.io
4. One Prompt, Every Agent in the Region: Zenity's AgentCorruption Turns ... — al-ice.ai