Zenity Labs Research Shows Single Prompt Can Hijack AWS AI Agents
New findings indicate a single prompt could compromise Amazon Bedrock AgentCore, exposing credentials and private data within the same account and region.
Key points
- Zenity Labs identified an attack chain named AgentCorruption targeting Amazon Bedrock AgentCore.
- The vulnerability allows exposure of private chats, source code, API keys, and OAuth tokens.
- A single prompt could hijack all agents in the same AWS account and region.
Zenity Labs published new research on Wednesday revealing that a single prompt sent to a public-facing AI agent could compromise Amazon Bedrock AgentCore. The researchers demonstrated that this flaw allows attackers to hijack agents and steal cloud credentials from the same AWS account and region.
According to Cyber Security News, the attack chain, named AgentCorruption, grants access to sensitive assets held within the agents. This includes private chats, source code, long-term memories, API keys, OAuth tokens, and other secrets. The scope of the exposure affects every agent in the affected environment.
Context and Background
The research highlights specific risks associated with Amazon Bedrock AgentCore, a service that allows developers to build AI agents. Zenity Labs found that the architecture permits a single input to traverse the security boundaries of multiple agents. This means one compromised agent can serve as a pivot point for broader account-level access.
The findings were reported by Cyber Security News, noting the severity of the potential data breach. The attack vector does not require complex multi-stage exploitation but relies on a single prompt. This simplicity increases the likelihood of accidental or malicious discovery by threat actors monitoring public-facing endpoints.
Who Is Affected
Any organization using Amazon Bedrock AgentCore with public-facing agents is potentially affected by these findings. The vulnerability specifically targets agents operating within the same AWS account and region. If one agent is exposed to the internet, the security of all other agents in that scope is compromised.
Zenity Labs emphasized that the exposure includes long-term memories and secrets. These elements are critical for enterprise applications that rely on persistent context and secure credential management. The impact extends beyond simple data theft to include the potential for lateral movement within the cloud infrastructure.
What should you do?
Organizations should immediately review their Amazon Bedrock AgentCore configurations to identify any public-facing agents. Security teams need to assess the permissions granted to these agents and restrict network access where possible. Monitoring logs for unusual prompt patterns or unauthorized access attempts is also recommended.
What to do and how to stay safe: AWS
- Audit all Amazon Bedrock AgentCore instances to remove unnecessary public exposure.
- Restrict agent permissions to the minimum required for their specific functions.
- Implement strict input validation on public-facing AI agent endpoints.
- Monitor AWS CloudTrail logs for anomalous activity related to agent interactions.
Step-by-step guide: Cloud Misconfiguration Response: Containment, Recovery and Prevention Steps
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the name of the attack chain identified in the research?
The attack chain is named AgentCorruption, identified by researchers at Zenity Labs.
What types of data can be exposed through this vulnerability?
The vulnerability can expose private chats, source code, long-term memories, API keys, OAuth tokens, and other secrets.
Does this affect all AWS services?
No, the research specifically identifies Amazon Bedrock AgentCore as the affected service within the AWS ecosystem.
