One Prompt Could Hijack AWS AI Agents and Steal Cloud Credentials

A single prompt sent to a public-facing AI agent could have exposed every Amazon Bedrock AgentCore agent in the same AWS account and region, according to new research from Zenity Labs. The attack chain, named AgentCorruption, gave the researchers access to private chats, source code, long-term memories, API keys, OAuth tokens, and secrets held in AWS Secrets Manager. Amazon Bedrock AgentCore is a managed service for building and running AI agents. Zenity found that an agent with a tool able to make web requests could be told to contact the local metadata endpoint at 169.254.169.254. This service provides temporary AWS credentials to cloud workloads. Because the request came from inside the agent’s Firecracker microVM, the...

Read the full article at the source.