Yes—Sonrai Security reported in September 2025 that code running in a sandboxed Amazon Bedrock AgentCore Code Interpreter could reach the interpreter’s MicroVM Metadata Service (MMDS) and retrieve its temporary AWS execution-role credentials. AWS documentation confirms that code or actors inside the VM can access credentials through that metadata endpoint, regardless of Code Interpreter network mode. The finding concerns this credential path in AgentCore, not every Amazon Bedrock agent or workload.
What the reported vulnerability allowed
Sonrai Security’s September 4, 2025 report describes accessing the MMDS endpoint from within the AgentCore Code Interpreter and obtaining the temporary credentials associated with its execution role. The researchers said simple string filtering could be bypassed. The key security issue is that sandbox network filtering did not provide a reliable credential boundary in the reported configuration.
As an Amazon Associate I earn from qualifying purchases.
Those credentials carry the permissions of the execution role. If obtained, they could potentially be used outside the interpreter to exercise that role’s AWS permissions. The report does not establish how many customers were affected, a prevalence rate, or that every AgentCore deployment was vulnerable in the same way.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
AWS’s credential-management documentation describes the underlying platform behavior: AgentCore Runtime, Browser, and Code Interpreter use MMDS to obtain temporary credentials for their execution roles. AWS warns that code or actors running inside the VM can call the metadata endpoint to access those credentials. This makes the role’s permissions central to the potential impact.
#1 Best Overall
Which components and controls matter
Code Interpreter and network mode
The 2025 report is specifically about the AgentCore Code Interpreter’s VM metadata credential path. Network isolation may constrain other traffic, but it should not be treated as credential isolation: AWS says access to MMDS credentials is independent of Code Interpreter network mode. A network-mode change alone therefore cannot be assumed to close this path.
Execution-role permissions
The execution role determines what an actor could do with credentials obtained from the VM. AWS recommends least privilege and says a resource’s execution role should have equal or fewer privileges than the users who can invoke that resource. Each AgentCore service has its own execution-role requirements, so permissions should be scoped to the service and its actual tasks.
Caller permissions
Check not only what a role can do, but who can invoke the resource that uses it. A caller with limited direct permissions may still be able to reach a more privileged execution context if invocation permissions are too broad.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteAgentCore Identity is a separate concern
AWS documents per-user credential scoping in AgentCore Identity’s Token Vault only for callers authenticated with a Bearer JWT through the OAuth inbound path. That condition applies to that identity configuration; it is not evidence that AgentCore Identity caused the Code Interpreter credential report.
What to review after a possible exposure
The following operational checklist applies AWS’s least-privilege guidance; it is not a claim that AWS published a universal incident-response procedure for this report.
- Inventory the components in use. Identify whether your workloads use AgentCore Code Interpreter, Runtime, Browser, the Starter Toolkit import workflow, or the harness API. The reported MMDS credential path concerns Code Interpreter.
- Inspect each associated execution role. Compare its permissions with the service’s actual needs and remove permissions that are unnecessary. Avoid assuming one shared role is appropriate across components.
- Review who can invoke each resource. Confirm that callers cannot invoke a resource whose execution role grants more privilege than those callers should be able to exercise.
- Assess credentials and activity if you suspect access. Use your organization’s AWS incident-response process to determine whether the role’s credentials may have been obtained or used unexpectedly, and take response actions appropriate to the role and observed activity.
- Do not treat network mode as the remediation. Because AWS describes the MMDS credential path as independent of Code Interpreter network mode, verify role scope and caller access rather than relying on a network setting alone.
The cited AWS guidance does not establish a universal customer-side software patch that fully remediates the specific 2025 MMDS behavior, nor does it establish that all customers were automatically fixed. Review the actual components, permissions, and invocation paths in your deployment.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Separate AgentCore advisories are not the same vulnerability
Two later 2026 advisories concern different components and should not be conflated with the 2025 MMDS credential report.
| Issue | Affected component and scope | Remediation stated by AWS |
|---|---|---|
| Starter Toolkit import flaws, October 6, 2026 | bedrock-agentcore-starter-toolkit versions 0.1.4 through 0.3.13 were affected by CVE-2026-105812, code injection during import, and CVE-2026-106032, external-reference handling that could cause network requests or local file access during import. |
AWS says version 0.3.14 addresses the issues. Affected agents need to be re-imported with 0.3.14 or later, and local and deployed output artifacts replaced. The toolkit was deprecated March 27, 2026; AWS points users to the AgentCore CLI replacement, which it says contains the equivalent fix. |
| Harness tool invocation, August 4, 2026 | CVE-2026-18830 affected the InvokeHarness API before July 31, 2026. An authenticated user could provide a tool-use content block in the final message and cause configured tools to run without model mediation. Impact was limited to tools configured on a given harness. | AWS says it added server-side input validation and no customer action is required. |
The toolkit issue concerns importing agent projects, and the harness issue concerns tool dispatch. Neither is the Code Interpreter’s MMDS credential path.
Best Value
How to judge your exposure
Start with the component, not the broad label “Bedrock agent.” Then evaluate the role attached to that component, the permissions of people or systems that can invoke it, and whether a separate versioned advisory applies to your workflow. For Code Interpreter, network mode does not answer whether the VM can access its temporary role credentials; AWS says that metadata access is independent of that setting.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
