Amazon Bedrock agent security flaw allowed credential theft and code access

What happened

A security vulnerability in Amazon Bedrock AgentCore, discovered by Zenity Labs researchers, could allow attackers to steal temporary credentials and access source code of AI agents (AI that carries out multi-step tasks rather than answering one question). Identity , IAM Technologies , AI/ML Amazon Bedrock agent vulnerability allowed credential theft and code access October 11, 2026 Share By SC Staff A security vulnerability in Amazon Bedrock AgentCore, discovered by Zenity Labs researchers, could allow attackers to steal temporary credentials and access source code of AI agents.

The vulnerability, which was present in earlier versions of AgentCore, could be exploited with a single prompt, with further coverage provided by The Register. The vulnerability stemmed from AgentCore's use of IMDSv1, which exposed temporary credentials for the AI agents.

These credentials, due to an overpermissioned default IAM role, allowed the attacker to enumerate and access other agents within the same AWS account and region. This included the ability to pull agent container images from Amazon Elastic Container Registry (ECR) and inspect their source code. Furthermore, the stolen credentials enabled access to user sessions and agent conversations stored in memory.