Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsZenity researchers reported that a prompt sent to one exposed Amazon Bedrock AgentCore agent could lead to credentials for its execution role and, in their tested AWS account and region, access to other agents and data. The impact they described depended on that role’s permissions; it does not establish that every AWS account or AgentCore deployment was compromised. AWS disputes Zenity’s characterization of the behavior as a vulnerability and recommends least-privilege execution roles.
How the reported attack chain worked
In its October 8, 2026 write-up, Zenity described an attacker who already had chat access to an exposed AgentCore agent. The attacker could use a prompt to direct the agent to reach its runtime’s metadata service. According to Zenity, a tool able to make network requests from inside the runtime could send a request to the link-local metadata address 169.254.169.254, creating a server-side request forgery (SSRF) path.
As an Amazon Associate I earn from qualifying purchases.
Zenity says the metadata service returned temporary credentials associated with the agent’s IAM execution role. Its technical posts say it reached the service using more than one tool, including a shell tool. That matters to the report’s argument: the claimed issue was not limited to a particular HTTP tool, but involved what a tool-enabled agent could reach from within its runtime. These are Zenity’s reported findings, not an independently reproduced test.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Zenity describes AgentCore agents as running in Firecracker microVMs and refers to the metadata service as IMDS. AWS’s current guidance calls its runtime metadata service MMDS, or MicroVM Metadata Service. The names reflect the terminology used by the respective sources; they should not be treated as evidence of two unrelated credential paths.
#1 Best Overall
What access Zenity reported after obtaining credentials
The credentials alone did not determine the outcome. The execution role’s permissions shaped what could be reached next. In the account and region Zenity tested, the researchers said the default role they examined had broad permissions across AgentCore resources. They reported using that access to:
- Discover other agents through CloudWatch log groups and retrieve container images from Amazon ECR.
- Invoke internal agents and read private session conversations.
- Modify short-term chat history and long-term memories.
- Access credentials in Secrets Manager or services related to AgentCore.
These are capabilities Zenity says it observed in its test environment, not guaranteed consequences for every deployment. The findings do not establish access to agents in other AWS accounts. AWS’s public statement specifically says cross-account access requires the developer to grant permissions on both the agent’s execution role and the target resource.
Why the memory result raised a persistence concern
Zenity said it created memory events that could influence future agent behavior, making the reported impact potentially longer-lived than access to a single conversation. The Next Web’s October 8 account says the planted instruction in Zenity’s demonstration directed an agent to revisit a researcher-controlled webpage before responding. This describes one reported demonstration; it does not show that every AgentCore memory setup can be altered or steered in the same way.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What AWS and Zenity say about the issue
The two positions differ. Zenity’s account focuses on a metadata-credential path and the broad permissions it says enabled lateral access within the same account and region. AWS disputes the vulnerability framing. The Next Web reported this statement from an AWS spokesperson on October 8, 2026:
Rank #3
“AWS is aware of the research published about Amazon Bedrock AgentCore, which inaccurately paints expected and documented behavior as a vulnerability. An agent can access resources in another AWS account only if the developer explicitly grants permissions on both the agent’s execution role and the target resource. As a best practice, we recommend that customers grant their execution roles only the permissions their agents need.”
The statement addresses AWS’s view of expected behavior and cross-account access; it does not erase the distinction between that question and Zenity’s report of broad access within its tested account and region. The Next Web corrected its earlier headline because it had presented the researchers’ claim as fact without that qualification.
Disclosure timeline and what changed
Zenity’s October 8, 2026 overview gives this disclosure timeline:
- December 25, 2025: Zenity says it disclosed the initial metadata-service finding.
- January 12, 2026: Zenity says it reported the broad execution-role blast radius.
- February 14, 2026: Zenity says AWS told it newly deployed agents used IMDSv2 only as of this date.
- February 25, 2026: Zenity says AWS told it work on the role issue was underway.
- April 12, 2026: Zenity says AWS closed the initial report as “informative.”
- June 22, 2026: Zenity says it found the role unchanged at that point.
- September 29, 2026: Zenity says its final review found substantial changes to the default role, including removal of permissions for cross-agent invocation, reading private conversations, and Secrets Manager access, with other permissions restricted.
The Next Web reported that Zenity’s disclosure did not include a CVE identifier. The reported role changes are not proof that a particular customer’s deployed runtime is secure; the attached role and runtime configuration still need to be checked.
Best Value
How to review an AgentCore deployment
AWS’s live Security best practices for AgentCore Runtime guidance, accessed October 9, 2026, says MMDSv2 must be enabled for agent runtimes starting June 30, 2026; runtimes without it cannot be invoked. AWS also recommends controls that address different parts of the chain. Review them together rather than treating one setting as a complete fix:
- Confirm metadata-service configuration. Check that each runtime has MMDSv2 enabled, particularly for deployments created before the June 30 requirement. AWS says runtimes without MMDSv2 cannot be invoked from that date.
- Reduce execution-role permissions. Compare every allowed action and resource against what the agent must do. Remove unneeded access to other agents, conversation data, memories, container images, and secrets; use resource-specific scope where applicable.
- Constrain who can assume the role. AWS recommends limiting the role’s trust policy with
aws:SourceArnandaws:SourceAccount. Check that the conditions and resource ARNs match the intended runtime and account rather than granting broad trust. - Manage outbound authentication deliberately. AWS recommends AgentCore Identity for outbound authentication. Review where credentials are stored and which external services the agent can reach.
- Validate prompts and tool use. Apply input validation and ensure tools expose only the operations the agent needs. Consider whether a tool can make arbitrary network requests or run shell commands from inside the runtime.
- Harden the container and network. AWS recommends running containers as non-root and applying appropriate network controls. Restrict egress to the destinations the workload requires.
These controls are complementary: metadata-service settings address access to runtime credentials, role scoping limits what those credentials authorize, and tool and network controls limit the paths an agent can use. AWS’s recommendations are configuration guidance, not proof that any single third-party product prevents this reported class of risk.
What the report does not establish
The incident sources and AWS guidance do not provide a prevalence estimate for affected customers, accounts, or agents. Zenity’s demonstrations concern a tested environment, and the reported impact depends on configuration. A headline about “every” agent should therefore be read as a description of the claimed reach within that account and region, not as evidence that every AgentCore agent across AWS was taken over.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
