Zenity tested an exposed AWS Bedrock AgentCore agent with HTTP-capable tools. A prompt induced tool-mediated access to instance metadata, revealing temporary execution-role credentials. In the originally tested configuration, the role granted permissions broad enough to enumerate and invoke other AgentCore agents, read conversation events, create memories…
Inspect the ClaimsCase · DiggingBeagle record
AgentCorruption demonstrated historical cross-agent access through AWS AgentCore default permissions
Zenity showed how an exposed AgentCore agent could be steered toward its metadata credentials and, under older default IAM permissions, access other same-account, same-region agents and secrets.
Scope
Controlled security research on past AgentCore default-role configurations and HTTP-capable agent tools; same AWS account and region. Not a verified in-the-wild customer compromise.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
Zenity documented a controlled AWS AgentCore prompt-to-tool-to-IAM chain. AWS disputed that an agent reaching its own role through instance metadata is itself a flaw. Zenity observed narrowed defaults by September 29, but no independent current production compromise or universal remediation verification is established.
Assessed Oct 11, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-AC-ROLE-BLAST · CLM-AC-DEFAULT-HARDENED · CLM-AC-AWS-DISAGREEMENT · Zenity Labs: AgentCorruption investigation and AWS response
At a glance
The dangerous transition requires both an agent tool able to reach local metadata and an execution role authorized to affect other agents. Denying metadata egress from tools removes the first step; least-privilege IAM removes the cross-agent blast radius even if role credentials remain reachable. Hardening AWS-generated defaults does not audit…
Read the implicationsWhether pre-hardening deployments and custom roles still grant the demonstrated same-account, same-region cross-agent privileges. Whether each affected deployment permits an agent HTTP-capable tool to contact the local metadata endpoint. No verified in-the-wild victim or independent confirmation of every currently deployed AWS default.
Limits and uncertaintyFull account
Zenity tested an exposed AWS Bedrock AgentCore agent with HTTP-capable tools. A prompt induced tool-mediated access to instance metadata, revealing temporary execution-role credentials. In the originally tested configuration, the role granted permissions broad enough to enumerate and invoke other AgentCore agents, read conversation events, create memories and access secrets across the account and region. The key amplifier was therefore IAM scope, not simply the model following a prompt. Zenity reported the two issues in December 2025 and January 2026, observed a significantly restricted default execution role by September 29, 2026 and published on October 8. AWS described access to the agent’s own execution-role metadata as documented behavior and emphasized least privilege, so this dossier does not characterize that metadata access alone as a newly acknowledged AWS vulnerability or claim the old cross-agent default remains deployed.
Mechanism and trust boundary
- 01
Prompt-mediated request
An attacker interacting with an exposed agent induces an HTTP-capable tool to contact local instance metadata.
Boundary: Untrusted conversation to agent network tool
- 02
Inherited role and cross-agent privileges
Temporary execution-role credentials combine with historically broad default IAM grants to reach unrelated agent sessions, memories and secrets.
Boundary: One agent execution identity to other agents and customer information
Timeline
- Sep 29, 2026mitigation
Default AgentCore roles narrowed
Zenity reported that the previously broad default permissions allowing cross-agent access were no longer present in its September review.
- Oct 8, 2026disclosure
AgentCorruption research published
Zenity published the demonstration and included AWS’s stated disagreement over the interpretation of own-role metadata access.
Claims & evidence
CLM-AC-ROLE-BLASTZenity demonstrated that prompt-steered AgentCore HTTP tool access could retrieve temporary metadata-service credentials which, with the then-default broad IAM role, permitted cross-agent invocation, conversation access and memory modification within one AWS account and region.supported
Basis: reported finding
- supportsZenity Labs: AgentCorruption investigation and AWS responseprimary disclosure
SSRF in AgentCore and IMDS Access; Overprivileged Role And Blast Radius; Memory Poisoning
CLM-AC-AWS-DISAGREEMENTAWS characterized an agent reaching credentials for its own execution role through instance metadata as expected behavior and recommended scoping IAM permissions to the least privilege required.supported
Basis: reported finding
- supportsZenity Labs: AgentCorruption investigation and AWS responseprimary disclosure
Statement from AWS
CLM-AC-DEFAULT-HARDENEDZenity reports that, by September 29, AWS had substantially restricted AgentCore default-role permissions, removing the wide cross-agent execution, conversation and Secrets Manager permissions that enabled its original escalation.supported
Basis: reported finding
- supportsZenity Labs: AgentCorruption investigation and AWS responseprimary disclosure
Responsible Disclosure, Report #2, September 29 timeline
Implications
The dangerous transition requires both an agent tool able to reach local metadata and an execution role authorized to affect other agents. Denying metadata egress from tools removes the first step; least-privilege IAM removes the cross-agent blast radius even if role credentials remain reachable. Hardening AWS-generated defaults does not audit customer-created or older custom IAM roles.
Unknowns and contradictions
- Whether pre-hardening deployments and custom roles still grant the demonstrated same-account, same-region cross-agent privileges.
- Whether each affected deployment permits an agent HTTP-capable tool to contact the local metadata endpoint.
- No verified in-the-wild victim or independent confirmation of every currently deployed AWS default.
Sources and citation
Material revision history
- Oct 11, 2026 · Published version · first publication · revision 123