AWS AgentCore security flaws expose credentials via metadata and weak VM isolation

Analysis reveals that AWS AgentCore’s security model is undermined by metadata token transmission, weak virtual machine isolation, and overly expansive permissions.

Threat Times Systems DeskOctober 11, 20262 min read

Share LinkedIn Reddit

Illustration: A translucent blue virtual machine container sits cracked open, revealing glowing credential tokens drifting out from inside. — AI-generated illustration: Threat Times

Key points

AWS AgentCore transmits security tokens in metadata, creating exposure risks.
Weak virtual machine isolation allows easier lateral movement for attackers.
Expansive permissions granted to the service simplify unauthorized access.

AWS AgentCore contains significant security design flaws that undermine its protective capabilities, according to a report by The Register. The analysis highlights that the service’s architecture relies on transmitting sensitive tokens through metadata, which creates a direct pathway for credential theft if an attacker gains initial access.

The Register identifies three primary weaknesses that make hacking AWS AgentCore significantly easier for threat actors. These include the transmission of tokens in metadata, insufficient isolation between virtual machines, and the assignment of expansive permissions to the service. These factors combined reduce the difficulty of escalating privileges once an entry point is established.

Context and Background

The security issues stem from fundamental architectural choices within AWS AgentCore rather than a single software bug. According to The Register, the service transmits authentication tokens in metadata, which can be intercepted or accessed if network controls fail. This design choice exposes credentials that would otherwise remain protected in more secure transmission methods.

Virtual machine isolation within the service is described as weak, allowing potential cross-VM attacks. The Register notes that this lack of robust separation means that compromising one instance may provide attackers with a foothold to explore other resources. This weak isolation contradicts standard security expectations for cloud-based infrastructure services.

Who is Affected

Organizations using AWS AgentCore are directly affected by these design vulnerabilities. The expansive permissions granted to the service mean that any user or process with access to AgentCore may have broader access to cloud resources than intended. This increases the attack surface for internal and external threats alike.

The Register’s findings suggest that the combination of metadata token exposure and weak VM isolation creates a high-risk environment. Security professionals managing AWS infrastructure should be aware that the default configuration of AgentCore may not provide sufficient protection against determined adversaries.

What should you do?

Security teams should review their AWS AgentCore configurations immediately to identify any unnecessary permissions. Organizations should also monitor for unusual metadata access patterns that could indicate credential theft. Until AWS addresses these architectural flaws, additional compensating controls are essential to mitigate the risk of unauthorized access.

What to do and how to stay safe: AWS

Audit AWS AgentCore permissions to ensure least-privilege access is enforced across all instances.
Monitor metadata endpoints for unauthorized access attempts or anomalous token retrieval activity.
Implement network segmentation to limit the impact of weak VM isolation between instances.
Review cloud security posture to identify other services with similar metadata or permission risks.

Step-by-step guide: Cloud Misconfiguration Response: Containment, Recovery and Prevention Steps

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.