AWS AI security flaw lets single prompt hijack all agents in account

Zenity Labs found a vulnerability in AWS Bedrock AgentCore that could let attackers compromise every AI agent within a single AWS account using just one public chat message.

Zenity Labs identified a critical vulnerability in AWS Bedrock AgentCore that allowed compromise of all AI agents within a single AWS account and region via one public agent. A single chat message could extract source code, private conversations, stored credentials, and long-term memory from all agents in the same account and region. The flaw enabled agents to access AWS Instance Metadata Service (169.254.169.254) and transmit credentials to external servers, with default execution permissions granting broad read/write/delete access across the entire AWS region. AWS responded by implementing IMDSv2 as default for new AgentCore deployments following Zenity’s December 25, 2025 report and tightening default execution roles around August 2025 to prevent agent-to-agent invocation and credential theft. Zenity recommends manual assignment of minimal-access roles for AI agents to mitigate systemic risks. The vulnerability persists if custom roles are misconfigured but can be prevented through proper role assignment. This security friction threatens enterprise AI systems where a single compromised public agent could expose sensitive data across an entire account’s infrastructure. The source notes the flaw affects multiple accounts with systemic configuration issues and requires only one public agent with chat access to initiate compromise. The vulnerability remains partially unaddressed despite AWS fixes, as researchers emphasize manual role configuration is critical for prevention.

Source: The Decoder