Google · The Register
AWS AgentCore security undone by prompt requesting credentials
Compiled by KHAO Editorial — aggregated from 1 source. See llms.txt for citation guidance.
◌ Single Source
Tokens transmitted in metadata, weak VM isolation, and expansive permissions make hacking a lot easier.
Key facts
- AgentCore's excessive permissions remained in place at least until June 22, 2026, when Zenity checked in and found the issue hadn't been remediated
- Researchers at Zenity Labs disclosed their findings to AWS in December 2025
- We discovered that agents deployed through AgentCore could access their instance's IMDS endpoints," said Tamir Ishay Sharbat and Lana Salameh in a blog post
- The Zenity researchers told Bob's tale, or something like it, to AWS last December, then followed up in January 2026 with details about AgentCore being overprivileged
Summary
Bob, possibly the same Bob whose conversations with Alice draw so much interest from eavesdropping Eve, was browsing a site they'll call TechHub. The endpoint returned data from the Instance Metadata Service ( IMDS ), which provides metadata about cloud instances and VMs at providers like AWS, Azure, and Google Cloud Platform. IMDSv2 addresses some of these risks, but back when Bob was browsing late last year, Bedrock AgentCore still used IMDSv1. The metadata provided to Bob by the helpful agent contained the agent's temporary credentials.