Evidence · DiggingBeagle record
Zenity Labs: AgentCorruption investigation and AWS response
Zenity researchers document AgentCore metadata-service credential access, former broad default IAM grants, disclosure chronology, observed narrowing of grants by September, and AWS response.
- Published
- Oct 8, 2026
- Publisher
- Zenity Labs
- Source role
- primary disclosure
Evidence record
Zenity researchers document AgentCore metadata-service credential access, former broad default IAM grants, disclosure chronology, observed narrowing of grants by September, and AWS response.
Claim-level citations (3)
- supportsAgentCorruption demonstrated historical cross-agent access through AWS AgentCore default permissions: Zenity demonstrated that prompt-steered AgentCore HTTP tool access could retrieve temporary metadata-service credentials which, with the then-default broad IAM role, permitted cross-agent invocation, conversation access and memory modification within one AWS account and region.
SSRF in AgentCore and IMDS Access; Overprivileged Role And Blast Radius; Memory Poisoning
- supportsAgentCorruption demonstrated historical cross-agent access through AWS AgentCore default permissions: AWS characterized an agent reaching credentials for its own execution role through instance metadata as expected behavior and recommended scoping IAM permissions to the least privilege required.
Statement from AWS
- supportsAgentCorruption demonstrated historical cross-agent access through AWS AgentCore default permissions: Zenity reports that, by September 29, AWS had substantially restricted AgentCore default-role permissions, removing the wide cross-agent execution, conversation and Secrets Manager permissions that enabled its original escalation.
Responsible Disclosure, Report #2, September 29 timeline