Zenity Labs discloses the AgentCorruption flaw chain in Bedrock AgentCore

On October 8, 2026, security firm Zenity Labs disclosed a vulnerability chain affecting Amazon Bedrock AgentCore and named it AgentCorruption. According to The Decoder, the researchers said that a single publicly accessible AI agent in an AWS account and region was enough to take over every AgentCore agent in that same account and region. The attack abused an internal AWS interface for issuing temporary cloud credentials, which agents could reach without restriction. The report said the chain could be triggered with just one prompt and could expose private conversations, source code, and stored credentials. Amazon Bedrock AgentCore is AWS's platform for running enterprise AI agents, offering tools, memory, and access management.

Later the same day, The Next Web reported the same findings: Zenity Labs used a single prompt sent to one public-facing AI agent on Amazon Bedrock AgentCore to take over every AgentCore agent in the same AWS account and region. That report added timing and venue details, saying the research was published on Thursday and presented in a talk at the SecTor 2026 conference in Toronto.

Both reports stated that AWS has since patched the issue and significantly tightened the agents' default permissions. The public record currently stops there: the flaw has been fixed, default permissions have been tightened, and Zenity Labs' research has been published and shared at the conference.