Zenity finds AWS AgentCore flaw that can hijack every agent in the same account
What happened
On 8 October 2026, security firm Zenity Labs disclosed via The Decoder that AWS's Bedrock AgentCore contains a vulnerability chain named AgentCorruption. According to Zenity Labs, an attacker needs only chat permission on one public agent to take over every AgentCore agent in the same AWS account and region with a single prompt, then read private conversations, source code and stored credentials. The report does not mention any response from AWS or whether a fix is available.
Written by AI from the reports · updated 7 d ago
Timeline
Follow the reports to see the event from each side.
- The DecoderOne public-facing AI agent on AWS could read, rewrite, and delete every other agent in the region
Zenity Labs researchers say a single publicly accessible AI agent on Amazon's Bedrock AgentCore was enough to take over every AgentCore agent in the same AWS account and region. The attack exploited an internal AWS interface for temporary cloud credentials that agents could reach without restriction. AWS has since patched the issue and significantly tightened the agents' default permissions.
Heat of this event
Current heat 3·Peak in the comparable range 6（Oct 9 17:00）·Change over 24 hours in the comparable range -50%
The trend compares only the same accounts observed without a break, so its range can be narrower than the current heat count. Move the pointer or tap the chart to see each hour; with a keyboard, use the left and right arrow keys.