Key points
- Zenity Labs identified the AgentCorruption attack chain affecting AWS Bedrock AgentCore.
- A single public-facing prompt could hijack all agents within the same AWS account and region.
- The flaw exposed private chats, source code, API keys, and OAuth tokens.
The short version
- Zenity Labs researchers demonstrated that a single prompt could hijack AWS AI agents.
- The vulnerability affects Amazon Bedrock AgentCore components within a specific AWS account.
- Attackers could steal cloud credentials, source code, and long-term memory data.
The details
Zenity Labs published research on an attack chain named AgentCorruption that targets Amazon Bedrock AgentCore agents. According to Cyber Security News, a single prompt sent to a public-facing AI agent could expose every agent in the same AWS account and region. This scope allows an attacker to pivot from one vulnerable agent to others within the same environment.
The researchers gained access to sensitive data held by these agents. This included private chats, source code, long-term memories, and API keys. The breach also exposed OAuth tokens and other secrets stored within the agent infrastructure. The attack chain relies on the interconnected nature of agents within a single AWS account.
The context
The vulnerability highlights risks in deploying AI agents with shared access controls. Amazon Bedrock AgentCore manages agent interactions, but the flaw allowed lateral movement. One compromised agent served as an entry point to others. This means that securing a single public-facing agent is insufficient if other agents share the same account context.
What should you do?
- Audit all public-facing AI agents for unnecessary permissions.
- Isolate agents into separate AWS accounts or regions where possible.
- Monitor logs for unusual prompt patterns or unauthorized data access.
- Review stored secrets and rotate any exposed API keys or tokens.
What to do and how to stay safe: AWS
- Inventory all Amazon Bedrock AgentCore instances and their exposure levels.
- Implement strict input validation for prompts sent to public-facing agents.
- Segment AWS accounts to limit the blast radius of a single compromise.
- Monitor agent logs for unexpected access to source code or credentials.
Step-by-step guide: Shared Responsibility Model: Where Your Security Ends
General security guidance from the DataSafe Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is AgentCorruption?
AgentCorruption is an attack chain identified by Zenity Labs that allows a single prompt to hijack AWS AI agents.
Which AWS service is affected?
The vulnerability affects Amazon Bedrock AgentCore agents within a specific AWS account and region.
What data was exposed in the research?
Researchers accessed private chats, source code, long-term memories, API keys, OAuth tokens, and secrets.
