Zenity claims AgentCore attack reached agents across one AWS account

Zenity Labs disclosed research on Thursday claiming that one prompt to a public-facing Amazon Bedrock AgentCore agent enabled access to other agents within the same AWS account and region. AWS disputes the characterization as a vulnerability, saying the behavior is expected and documented. The researchers used an agent's web-request tool to retrieve temporary execution-role credentials from AWS's instance metadata service. Zenity says broad role permissions then allowed access to agent code, private conversations and stored secrets, while planted memories enabled persistent instructions. On 29 September, Zenity found AWS had narrowed the role, removing permissions to invoke other agents, read private conversations and access Secrets Manager.