Researchers hijacked every AI agent in an AWS account with one message to a public agent on Bedrock AgentCore

Zenity Labs says one chat message to a publicly reachable agent on Amazon Bedrock AgentCore was enough to take over every AgentCore agent in the same AWS account and region. The agent was asked to query an internal metadata address and hand back its own credentials, which it did. With broad default permissions, the researchers could reach source code, passwords, private chats and agent memory. AWS has partly fixed it.

• If you or your developer runs agents on AWS, give each agent its own role with only the access it needs, rather than relying on the defaults.
• Do not put a public chat agent in the same account and region as agents that hold customer data, or secrets, until you have checked what it can reach.

Source: The Decoder. This is our short summary of their reporting. The paragraphs marked "Our read" and the things to do are SeedFoundry's opinion. The summary is drafted with AI tools. Image: Amazon Web Services, from its own announcement. How we source and credit