Executive Summary
A reported prompt-injection attack could use permitted tools in Amazon Bedrock AgentCore to access other agents and sensitive cloud data. Organizations operating AI agents in AWS should review agent permissions, isolation, and secret-handling controls.
What Happened
Zenity Labs reported AgentCorruption, an attack against Amazon Bedrock AgentCore in which a prompt injection could abuse permitted web or shell tools to access other agents in the same account and region. The researchers said exposed data could include private chats, source code, agent memories, API keys, OAuth tokens, and AWS Secrets Manager secrets; AWS reportedly removed broad permissions by September 29.
Affected Products
- Amazon Bedrock AgentCore
- AWS Secrets Manager
Vulnerability / Attack Technique
Prompt injection abusing agent tools
Technical Mechanism
The reported attack used prompt injection to abuse permitted web or shell tools. Those tools could reportedly provide access to other agents in the same AWS account and region, exposing data such as agent memories, API keys, OAuth tokens, and AWS Secrets Manager secrets.
AI Security Category
LLM06:2025 Excessive Agency
Relevant Frameworks
RealGround Analysis
This matters because an injected instruction could reportedly turn authorized agent capabilities into cross-agent access and credential exposure. Teams running AI agents should treat tool permissions, agent-to-agent boundaries, and cloud secret access as security-sensitive business logic requiring testing and continuous review.
Recommended Controls
- Apply least-privilege permissions to agent web, shell, and cloud-service tools.
- Enforce strict isolation between agents, accounts, and regions.
- Prevent agents from directly accessing or returning API keys, OAuth tokens, and Secrets Manager secrets.
- Red-team prompt-injection paths that invoke tools or attempt cross-agent access.
- Monitor and alert on unusual agent-to-agent access, shell execution, secret retrieval, and data exfiltration.
Related RealGround Service
AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.
Sources
CybersecurityNews: https://cybersecuritynews.com/agentcorruption-attack/?ref=bedrockbrief.com
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.