Disclosed vulnerability
AgentCorruption: AgentCore metadata credentials enable regional lateral access and persistent memory-driven conversation exfiltration
AIR-2026-0272 AIR record · 2026-10-aws-agentcore-agentcorruption
From the supporting source
It worked. The microVM did not restrict traffic to the metadata service, and the agent happily relayed the response back to us.labs.zenity.io
The record
Disclosed
2026-10-08
Vendor
Amazon Web Services
Product
Amazon Bedrock AgentCore Runtime and Memory; demonstrated with a Strands SDK agent
Risk domain
Access control and permissions › Confused deputy
Also touches
Data and memory poisoning, Credential theft, Privilege escalation, Data exfiltration channels, Sensitive data exposure
System type
Generative model
Who acted
Agent acted — the demonstrated agent queries metadata credentials and later retrieves attacker instructions and transmits conversations through tools
Attack surface
Agent framework
Autonomy level
Semi-autonomous
Initial vector
Direct prompt induced metadata request
Impact type
Credential theft, Unauthorized access, Information disclosure, Memory poisoning, Agent hijack, Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0054 – LLM Jailbreak
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- —
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Validate delegation chains; Use signed attestations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
All AgentCore agents in the same AWS account and region (demonstrated in Zenity's own account)
Capability abused
Defense & remediation
Recorded defense
Firecracker microVM isolation; execution-role IAM permissions
Guardrail kinds
Sandbox isolation, Permission scope
Guardrail outcome
Silent
Fix shipped
New agents use IMDSv2 only from 14 Feb 2026; AWS closed the report as informative
Taxonomy & references
Curator notes
Zenity Labs (Lana Salameh, Dmitry Lozovoy), five-part series published 8 Oct 2026; reported to AWS in December 2025 (the post gives both 17 and 25 Dec). A plain prompt made a Strands agent with an HTTP tool fetch the metadata endpoint and send back its execution-role credentials, which worked from outside AgentCore. The default role's wildcard permissions then reached every agent in the same account and region: container images, conversations, memory and secrets. Poisoned memory gave persistence. Everything was demonstrated in Zenity's own account; no customer victims. AWS says the behavior is documented and expected and recommends least-privilege roles.
Supporting sources
Cite as
Enkrypt AI. "AgentCorruption: AgentCore metadata credentials enable regional lateral access and persistent memory-driven conversation exfiltration". AIR, AIR-2026-0272. https://agentincident.vercel.app/i/AIR-2026-0272/ (accessed 2026-10-19).