One Prompt Compromised Every AWS Agent in an Account, Zenity Reports
Zenity Labs disclosed AgentCorruption, a chain of AWS Bedrock AgentCore flaws where one prompt injection against a public-facing agent exposed the instance metadata endpoint and cloud identity, then planted instructions in AgentCore Memory for persistent hijacking. The default IAM role allowed reading private chats, copying source code, and stealing secrets across the account. AWS patched some attack paths.
On this page
One prompt, then the whole account
Zenity Labs disclosed AgentCorruption on 6 October: a chain of flaws in AWS Bedrock AgentCore that turned a single prompt injection against one public-facing agent into compromise of every agent in the same AWS account, and across the region. The entry point was embarrassingly small: one prompt to a public agent exposed the instance metadata endpoint, the agent's cloud identity, and the internals of its container.
From there the chain got worse. Zenity showed attackers could plant instructions in AgentCore Memory, the feature meant to give agents continuity, so that the hijack survived the initial compromise and re-triggered on later sessions. The account's default IAM role then allowed reading private chats, copying source code, and stealing secrets, which turned every other agent in the account into a downstream casualty of the first one's exposure.
AWS patched some of it, and disputed the rest
AWS issued patches for parts of the chain by late September, and the company characterized aspects of the findings as working as intended, disputing the severity framing. CSO Online's analysis of the disclosure cuts to the unresolved part: patching one attack path has still left others open, which Zenity's two-part technical series documents in detail, from the initial IMDS access to the memory-weaponization technique.
The dispute is worth reading closely because it previews the argument every agent platform will eventually have. Platform vendors tend to model a prompt injection as an application-level bug belonging to the developer who built the agent; security researchers model the blast radius as a platform property, because a default IAM role that can read every chat in the account turns any single developer's mistake into everyone's problem. Both descriptions are accurate; the disagreement is about who owns the fix.
What this means for anyone deploying agents
The transferable lessons are configuration-level, not model-level. First, the metadata endpoint exposure means an agent's runtime environment is inside the attack surface: lock down IMDS, scope the identity, and assume the container is readable. Second, memory is an attack surface: anything an agent remembers persistently is something an attacker can poison, so treat agent memory like untrusted user content with a lifetime. Third, default roles that can read all chats and source code in an account convert one team's agent into every team's breach.
This lands the same week Pwn2Own added AI infrastructure as a medal category and a security firm demoed encrypted prompt injection against a coding agent. The pattern across all three is identical: the model behaved, and everything around it, identity, memory, file access, and egress, decided how bad the outcome was. Agents in production need that perimeter designed, not defaulted.