Zenity Labs Uncovers 'AgentCorruption' in AWS Bedrock AgentCore, Highlighting Cloud Agent Security Gaps

Zenity Labs researchers, Tamir Ishay Sharbat and Lana Salameh, recently unveiled a critical vulnerability dubbed "AgentCorruption" at SecTor 2026. This chained exploit allows a single prompt to a public-facing AWS Bedrock AgentCore agent to compromise every other agent within the same AWS account and region. The attack leverages Server-Side Request Forgery (SSRF) to manipulate the agent into making unauthorized requests to internal resources, specifically querying the Instance Metadata Service (IMDS) at `169.254.169.254`. This was possible due to insufficient network isolation in the underlying Firecracker MicroVMs, enabling the agent to retrieve temporary AWS credentials. This disclosure is significant for any organization utilizing or planning to deploy AI agents on AWS, particularly with Bedrock AgentCore. It underscores a fundamental challenge in cloud security: the rapid evolution of services, especially in the generative AI space, often introduces new attack vectors that may not be immediately obvious or adequately secured by default. While AWS initially characterized the behavior as "documented and expected," their subsequent release of hardening measures, including making IMDSv2 the default for new deployments and significantly reducing the permissions of execution roles, indicates a recognition of the severity and the need for improved security. For practitioners, this means that the shared responsibility model extends deeply into the configuration and deployment of AI services, requiring a proactive and informed approach to security. The "AgentCorruption" exploit fits into a broader trend of vulnerabilities emerging in the burgeoning field of AI/ML security. As AI models become more integrated into critical workflows, the focus shifts from traditional infrastructure security to securing the AI itself, including its inputs, outputs, and the underlying execution environment. This incident highlights the importance of securing the "agentic" nature of these AI systems, where agents can interact with and potentially control other resources. The vulnerability echoes past concerns around misconfigured cloud resources and over-privileged roles, but with the added complexity of AI's autonomous capabilities. The AWS Security Blog has also recently highlighted the increasing sophistication of AI models in uncovering security vulnerabilities, further emphasizing this trend. In practice, this means that developers and security teams must prioritize several key areas. Firstly, rigorous network segmentation and isolation are paramount for AI agent deployments, ensuring that agents cannot access internal services or metadata endpoints they don't explicitly need. Secondly, the principle of least privilege must be strictly applied to the IAM roles associated with AI agents, limiting their permissions to only what is absolutely necessary for their function. Regularly auditing these permissions is crucial. Thirdly, the use of IMDSv2 should be enforced, and practitioners should be aware of and implement any further hardening measures released by AWS. Finally, organizations should invest in continuous security assessments and penetration testing specifically tailored to their AI workloads to identify and mitigate novel attack paths. This incident serves as a stark reminder that the security posture of AI services is a dynamic and evolving challenge that demands constant vigilance and adaptation.