Amazon Bedrock agent vulnerability allowed credential theft and code access

* Zenity Labs researchers discovered a security vulnerability in Amazon Bedrock AgentCore.
* The vulnerability allowed attackers to steal temporary credentials and access source code of AI agents.
* The flaw originated from AgentCore's use of IMDSv1, which exposed temporary credentials for AI agents.
* An attacker could trigger a server-side request forgery (SSRF) attack to obtain these credentials via a single prompt.
* The credentials, due to an overpermissioned default IAM role, allowed enumeration and access to other agents in the same AWS account and region.
* Access included pulling agent container images from Amazon Elastic Container Registry (ECR) and inspecting their source code.
* The stolen credentials enabled access to user sessions and agent conversations stored in memory.
* Zenity Labs disclosed findings to AWS in December 2025.
* AWS updated AgentCore to exclusively use IMDSv2 by February 2026.
* The excessive permissions issue persisted until at least September 2026 when AWS addressed the concerns.

The narrative traces a clear progression from an underlying technical implementation flaw (using IMDSv1) to a severe resulting access escalation due to overly permissive identity management, culminating in a delayed remediation timeline for critical security exposures. The core pattern reveals a structural gap between implementing a new standard (IMDSv2 adoption by AWS) and achieving comprehensive security hardening across inherited permissions. The persistence of the excessive permissions issue until September 2026 suggests that applying technical fixes is not sufficient; systemic governance around default IAM roles and permission boundaries requires extended auditing beyond immediate patch deployment. This reflects a broader implication in the development of complex AI systems where security is often addressed as an add-on rather than being foundational to the architecture from inception. The pattern suggests that technological advances in agent systems introduce new attack surfaces that are only mitigated through layered, persistent scrutiny of access controls, rather than treating security fixes as terminal events.
Bridge Questions: How do evolving security standards (like IMDSv2) intersect with legacy system permissions in complex cloud environments? What systemic accountability structures must be in place to ensure that permission exposure is addressed before and concurrently with feature deployment? What are the long-term consequences when critical access controls are deferred across extended timelines?