Single prompt could hijack every AI agent in an AWS account, Zenity researchers find

Zenity Labs says that simply sending one prompt to a publicly accessible AI agent can take over all AgentCore agents in the same AWS account and region. The organization named this series of vulnerabilities "AgentCorruption" and says it is a systemic problem affecting agents with built-in tools across multiple AWS accounts.

The attack entry point points to the instance metadata service that AWS runs at the internal address 169.254.169.254, which is used to issue temporary credentials. Zenity says AgentCore lacked proper isolation, and the agent complied when asked to query that service and send the results to an external server. Based on this, the researchers said, "the sandbox boundary we were supposed to be fighting simply did not exist."

Zenity says the stolen credentials could be used on the researchers' own machines outside the platform, and that the metadata service also leaked certificate and key material for internal AWS services, as well as internal S3 presigned URLs that did not belong to the researchers' account. The researchers also say that removing the web tool did not help, because the flaw was in the platform itself, and they carried out the same attack through a command-line tool.

Zenity says the takeover was possible because AgentCore's default permissions are not limited to the single agent receiving them, but apply to every agent in the same account and region, and grant read, write, and delete permissions capable of destructive operations.

With these permissions, Zenity says it could list all agents, download their code packages within seconds, and invoke them one by one, and these code packages often contain forgotten passwords or API keys. The researchers also say the stolen credentials allowed them to read private conversations between other users in the region and any AgentCore agent.

For agents with long-term memory enabled, Zenity says it could tamper with memory to influence future behavior and implant instructions causing the agent to forward subsequent conversations to an external destination. Users would continue talking to an apparently trustworthy agent without any awareness.

Zenity also says AgentCore's default permissions allow agents to access stored credentials, including keys for services outside AWS, thereby weakening the protection of AWS's recommendation to store passwords and API keys separately.

Zenity says it reported the AgentCore findings to AWS on December 25, 2025, after which AWS made IMDSv2 the default configuration for new AgentCore deployments. IMDSv2 is a more secure version of the metadata service, and that service was precisely the entry point for Zenity's attack.

According to Zenity's updated account, AWS also changed AgentCore's default execution role around August, no longer allowing agents to invoke other agents, read private conversations, or obtain credentials from AWS Secrets Manager, and significantly restricted other permissions.

But the researchers still recommend that enterprises create custom roles with narrower access permissions. The source does not provide complete confirmation of whether AWS has fully fixed the vulnerability chain, and AWS's official statements on the scope of the vulnerability, the content of the fixes, and the timeline are also not presented in the source.

Zenity Chief Technology Officer Michael Bargury said cloud security is about isolation and least privilege, but AI agents need creative freedom to be useful, and the two conflict.

This conflict is especially prominent when publicly facing agents and internal agents share an environment: in such a setup, a single vulnerability can breach the security boundary of the entire system. The path Zenity describes—pivoting from a public customer service agent to an internal finance agent and accessing its data—is precisely a concrete manifestation of this risk.

It should be noted that the above technical details all come from Zenity's own blog and lack independent third-party verification; the actual number of affected enterprise customers and whether real attacks occurred remain unclear.

Zenity sells a security platform for AI agents, so it has a commercial interest in reporting vulnerabilities in this field. This identity does not negate its findings, but it means the relevant conclusions should at most be regarded as source claims.

The finding continues a pattern previously documented by Zenity: in the AgentFlayer research, zero-click attacks caused Salesforce Einstein, Copilot Studio, and Cursor to redirect customer data or leak credentials; in AgentForger, a tampered ChatGPT link was enough to create autonomous agents in OpenAI Workspace Agents that disabled approval requirements.

Reports say OpenAI fixed its vulnerability within four days, while AgentCore's overly broad default permissions persisted for months after Zenity's report. AWS has opened AgentCore to all enterprises, and Amazon says its users include Sony and Ericsson.