Science & Tech · Cybersecurity · 3 hrs ago
Amazon Bedrock flaw exposed AI agent credentials and source code
A vulnerability in earlier versions of Amazon Bedrock AgentCore could let an attacker use a prompt to steal temporary credentials for AI agents.
AgentCore is an AWS service, and the flaw affected agents in the same AWS account and region.
Researchers at Zenity Labs found that the service used a method that exposed credentials and that a default access role had excessive permissions.
With the stolen credentials, an attacker could access other agents, inspect their code, and view stored user sessions and conversations.
Zenity Labs disclosed the issue to AWS in December 2025.
AWS changed AgentCore to use a more secure credential method by February 2026, but the excessive permissions remained until AWS addressed them by September 2026.
The flaw mattered because it could expose both agent code and user data.
A vulnerability in Amazon Bedrock AgentCore could let attackers steal AI agents’ temporary credentials and access their source code.
Researchers at Zenity Labs found that a crafted prompt could trigger a server-side request forgery attack.
The flaw involved AgentCore’s use of IMDSv1 and an overpermissioned default IAM role.
Stolen credentials could also expose other agents, user sessions and conversations stored in memory.
AWS switched AgentCore to IMDSv2 by February 2026 and addressed remaining permission concerns by September 2026.
- Who
- Zenity Labs researchers discovered the vulnerability. AWS updated AgentCore.
- What
- A flaw could let attackers steal temporary credentials and access AI agents’ source code, sessions and conversations.
- When
- Zenity Labs disclosed the findings in December 2025. AWS made updates by February 2026 and addressed remaining concerns by September 2026.
- Where
- Amazon Bedrock AgentCore, in AWS accounts and regions.
- Why
- AgentCore used IMDSv1, and its default IAM role had excessive permissions.
This story does not have two clearly opposing sides.
No direct quotes in the coverage so far.
Zenity Labs disclosed its findings to AWS.
AWS updated AgentCore to use only IMDSv2.
AWS addressed the remaining security concerns related to excessive permissions.
- Researchers
- Zenity Labs
- Credential exposure mechanism
- IMDSv1
- Initial disclosure
- December 2025
- Credential update
- AgentCore switched to IMDSv2 by February 2026
- Remaining permissions issue
- Addressed by September 2026
Sources
Related news
Yandex services disrupted after Ukrainian drone strikes on Russian data centers
Dropbox launches data access governance tool in Singapore
US seizes two China-linked hacking tools used against critical infrastructure
Canadian cybersecurity executive arrested in U.S. hacking case
Anthropic offers free AI vulnerability scans to open-source projects
FBI arrests another suspect linked to ShinyHunters jobs-site breach
New characters let lookalike domains bypass some browser checks
Hackers use Bing redirects in Google ads to promote fake Claude installers
Canadian cybersecurity negotiator arrested in ShinyHunters investigation
Canadian cybersecurity executive arrested on extortion-related charges
AhnLab to Enable AI and Internet Access on Research Foundation Work Network
