Zenity Labs found that weaknesses in cloud isolation and access permissions could expose AI agent credentials, conversations and stored information. AWS has since addressed the reported issues but disputes their classification as vulnerabilities.
Security researchers have identified weaknesses in Amazon Web Services' (AWS) Bedrock AgentCore platform that could allow attackers to extract cloud credentials and gain access to multiple AI agents within the same AWS account and region.
The findings, disclosed by cybersecurity firm Zenity Labs, highlight security concerns surrounding enterprise AI agents that operate with access to cloud infrastructure, stored information and external services.
According to researchers Tamir Ishay Sharbat and Lana Salameh, an attacker with access to a publicly available AI agent could manipulate it through a specially crafted prompt to retrieve sensitive credentials from its underlying cloud environment.
The attack involved AWS's Instance Metadata Service (IMDS), which provides information about cloud instances, including configuration details and temporary security credentials.
Researchers found that AgentCore workloads could access metadata endpoints because of insufficient network isolation within the Firecracker microvirtual machines used by the platform.
At the time of the initial research, AgentCore used IMDSv1, an earlier version of the metadata service. The researchers demonstrated how an agent could be instructed to retrieve temporary AWS credentials through a server-side request forgery technique.
The issue was compounded by broad permissions assigned to the default AgentCore role, which extended across multiple AgentCore resources within the same AWS account and region.
Using the credentials, researchers said an attacker could identify other agents, access their container images through Amazon Elastic Container Registry and inspect application code.
The permissions could also enable access to agent sessions, stored conversations and memory resources. Researchers reported that the same access could be used to modify agent memories, potentially influencing their behaviour during subsequent interactions.
Zenity first disclosed its findings to AWS in December 2025 and submitted additional information about excessive permissions in January 2026.
AWS subsequently confirmed that AgentCore had transitioned exclusively to IMDSv2 by February 14, 2026, addressing the metadata service issue identified during the research.
However, Zenity reported that excessive permissions remained unresolved during a follow-up assessment on June 22.
A further review conducted on September 29 found that AWS had addressed the outstanding issues, according to the researchers.
Amazon disputed the interpretation of the findings, stating that Zenity had characterised documented platform behaviour as a vulnerability. The company maintained that developer misconfiguration would be necessary for the reported attack scenario to occur.
The disclosure comes as businesses increasingly deploy AI agents for customer support, workflow automation, software development and other enterprise functions.
The research draws attention to the importance of access controls, credential management and workload isolation when AI agents interact with sensitive business systems.
No evidence of widespread exploitation or confirmed customer data breaches was reported in connection with the findings.
Article length: approximately 460 words. Source verified against The Register's October 9, 2026 report. The findings are attributed to Zenity Labs, and Amazon's response is included to reflect the dispute.
Disclaimer: This article may include information derived from interviews, press releases, public statements, research, company communications and other publicly available or third-party sources. Such material may be summarised, paraphrased or contextualised for journalistic and editorial purposes. All rights in third-party content remain with their respective owners.