New to this? Read it in simple words
- Researchers asked a public AI agent on AWS for its cloud keys, and it gave them.
- With those keys, they say, an attacker could control other agents in the same account.
- AWS says this is expected, documented behaviour, not a flaw.
- Zenity says AWS has since narrowed the default permissions.
- Prompt
- A message or instruction that a person types to an AI model or agent.
- Role
- In the cloud, a set of permissions that says what a program may use.
- CVE
- A public number given to a known security flaw, so everyone can track it.
Amazon Bedrock AgentCore is AWS’s service for running AI agents in the cloud. Each agent gets a role: a set of permissions that says which cloud resources it may use.
What the researchers found
Zenity Labs researchers Tamir Ishay Sharbat and Lana Salameh call the attack “AgentCorruption”. They published it on October 8 and presented it at the SecTor 2026 conference in Toronto.
Agents on AgentCore Runtime run in small virtual machines. Zenity says those machines could reach a cloud address that hands out the agent’s temporary keys.
In Zenity’s test, a user who could only chat with a public agent asked it to open that address with its web tool. The agent fetched the page and returned its keys.
The steps in Zenity Labs’ demonstration of October 8; AWS says the behaviour was expected and documented.
How far it reached
The default role applied to every agent in the same AWS account and region, Zenity says. With its keys, an attacker could call other agents, copy their code, read private conversations, take stored secrets and plant false memories.
Zenity says the attack never crossed from one AWS account to another. It says it saw no sign that anyone used the method in real attacks, and no CVE number was issued.
Two readings of the same facts
Zenity reported the problems to AWS on December 25, 2025 and January 12, 2026. From February 14, new agents used a safer version of the key service, AWS says according to Zenity. AWS closed the first report as “informative” on April 12.
On September 29, Zenity saw that the broad default permissions were gone. AWS says the research “inaccurately paints expected and documented behavior as a vulnerability”. It recommends giving each agent only the permissions it needs.
Sources
Every fact in this story comes from the sources below. Open them to check our work.
- 1Primary source · October 8, 2026AgentCorruption: How A Single Prompt Collapsed The Entire Cloud Security Model Zenity Labs
- 2Primary source · October 8, 2026AgentCorruption: AWS AgentCore Flaws Let One Prompt Hijack All Agents Zenity
- 3Research · October 9, 2026AWS AgentCore security undone by prompt requesting credentials The Register
- 4Research · October 8, 2026AWS’s repeated problems with AI agent controls illustrates the autonomous agent dilemma CSO Online
- 5Research · October 8, 2026Zenity says one prompt took over every AgentCore agent in an AWS account TNW
- 6Research · October 9, 2026A Single Prompt Could Lead to ‘AgentCorruption,’ Zenity Says Security Boulevard
- 7Research · October 8, 2026One public-facing AI agent on AWS could read, rewrite, and delete every other agent in the region The Decoder
The attack and what it could reach are Zenity’s own demonstration. AWS disputes that it was a vulnerability, and the date of AWS’s fix is Zenity’s observation.
One chat message could take a public AWS agent’s cloud keys and control every agent in the account, though defaults were narrowed. How we rate the mood