A single prompt was enough to take over every agent in an AWS Bedrock AgentCore account
Prepared by Sintelligent with the help of SI. Published in SI: . Updated: .
The more rights agents get by default, the more important minimal rights become, which is an engineering task, not a reason to stop.
According to Zenity researchers (as relayed by The Next Web), the agent's web-request tool was used to obtain temporary credentials from the metadata service, and the broad default role opened resources across the whole account and region: the list of agents, source code, private conversations and secrets. Write access to the agent's memory, they say, made the takeover persistent. AWS, according to the same report, considers the behavior documented and expected rather than a vulnerability; no CVE was assigned, and on September 29, 2026 AWS narrowed the default role's permissions.
Sources 1