Zenity Labs discloses AgentCorruption chain in Amazon Bedrock AgentCore

At SecTor 2026, Zenity Labs disclosed the AgentCorruption chain in Amazon Bedrock AgentCore: a single prompt to a public agent returned temporary credentials via the instance metadata service at 169.254.169.254, and a default execution role granted access to every agent in the account. AWS moved AgentCore to IMDSv2 by February 14, 2026, and removed the broader default-role permissions by September 29, 2026, 278 days after the initial report.

• One prompt to a public agent returned credentials via 169.254.169.254
• Default role allowed invoking and reading every agent in the account
• AWS moved AgentCore to IMDSv2 by February 14, 2026
• Broader role permissions removed September 29, 2026, 278 days later