AWS Bedrock AgentCore has delivered a useful reminder that the future of autonomous software may still be defeated by the ancient spell known as “please fetch this URL.”
As reported by The Register, researchers at Zenity Labs found that an externally reachable agent could be prompted into retrieving cloud instance metadata, exposing temporary credentials. Those credentials could then be used to enumerate other agents in the same AWS account and region, pull container images, inspect source code, read sessions, write memories, and potentially fetch secrets. A single chat prompt, in other words, briefly became a master key wearing a customer-service smile.
🤚 The Open-Palm Credential Fountain
The scenario begins with an agent hosted through Amazon Bedrock AgentCore. A user asks it to inspect a URL. The URL points to an Instance Metadata Service endpoint, the cloud convenience feature that provides details about a running environment: region, availability zone, networking, images, injected keys, and sometimes temporary security tokens.
Metadata services are not inherently scandalous. They are the hotel front desk of cloud computing. The problem arrives when a workload can be coaxed into calling the desk on behalf of a stranger and reading the key envelope aloud.
According to Zenity’s account, AgentCore was still using IMDSv1 when the researchers reported the issue in December 2025. The researchers said the AgentCore environment allowed access to metadata endpoints, enabling a server-side request forgery-style attack. The agent fetched temporary credentials for its assigned IAM role, and those credentials were useful beyond the single agent that leaked them.
👐 The Two-Handed Isolation Problem
Zenity’s researchers said the underlying issue included insufficient network isolation in the Firecracker MicroVM environment used by AgentCore and an overly broad default role scoped to all AgentCore resources in a region rather than a single agent. That combination is the cybersecurity equivalent of a luxury hotel where every minibar key also opens accounting, the spa, and the guest memory archive.
The exposed temporary credentials reportedly allowed an attacker to enumerate other agents, log into Amazon Elastic Container Registry, pull agent container images, run them as root for inspection, and access memory resources containing users and agent sessions. Zenity also said the permissions could be used to create new memories across agents and users, persistently altering future behavior.
That last detail is especially fragrant. Agent memory is marketed as continuity, personalization, and intelligence with a scrapbook. In a security incident, memory becomes persistence with a nicer font. A compromised agent that can write durable instructions into another agent’s future is not merely leaking data; it is leaving poisoned stationery for tomorrow’s automation.
🌿 The Gentle Awakening
The old cloud rule was simple: protect credentials because credentials are the kingdom. The new agentic rule is less elegant and more expensive: protect every path by which a conversational interface can become a credential retrieval system, lateral movement assistant, memory editor, or container archaeology intern.
This is not just an AWS story. It is an architecture story. AI agents collapse the distance between natural language and infrastructure action. A prompt is not “just text” when the thing reading it can browse, fetch, authenticate, store, call APIs, and summarize the evidence with tasteful bullet points.
Security teams should treat agent runtimes as workloads with identities, permissions, network paths, and blast radii. That means scoping IAM narrowly, blocking metadata endpoints unless explicitly required, enforcing IMDSv2-style protections where applicable, isolating agent networks, logging tool calls, separating memories by tenant and agent, and assuming that any exposed agent will eventually be asked to do something rude in JSON.
👑 The Gold-Leaf Reckoning
The Register notes that Zenity disclosed findings to AWS in December 2025, followed up in January 2026, and AWS later said the report was “informative” and closed it, stating that as of February 14, 2026, AgentCore had been updated to use IMDSv2 exclusively. That is progress. It is also a useful public exhibit in the museum of “default permissions matter more after you add a chatbot.”
The premium lesson is not that agents are doomed. The lesson is that agent infrastructure must be designed with the assumption that prompts are adversarial input, tool use is execution, memory is state, and cloud credentials are not decorative mints on the pillow.
If your AI agent can touch infrastructure, then your AI agent is infrastructure. Dress accordingly.
“We asked the assistant for a summary and received regional administrative ambition.” — The Slap of Wisdom Department of Cloud Butler Containment, after discovering the concierge had keys to the penthouse