Zenity Labs Says One Prompt Took Over Every AgentCore Agent in One AWS Account
Summary
Zenity Labs says a single prompt to one public-facing agent let it take over every agent in the same AWS account and region. The researchers say AgentCore's default role exposed private chats, source code and Secrets Manager credentials. AWS says the behavior is documented, not a vulnerability, and narrowed the role on 29 September.
Key Points
- Zenity Labs says its researchers reported the metadata access issue to AWS on 25 December 2025.
- Zenity co-founder and chief technology officer Michael Bargury says mixing cloud segmentation with agents' creative space creates an inherent conflict.
- AWS says newly deployed AgentCore agents launch with IMDSv2 only, which requires a session token for each request.