Key points
- Zenity Labs identified AgentCorruption flaw in AWS Bedrock AgentCore.
- Single prompt could expose private chats, code, and API keys.
- Attack chain grants access to secrets within same account and region.
Zenity Labs research indicates a single prompt could hijack public-facing Amazon Bedrock AgentCore agents, according to Cyber Security News. The findings highlight risks for organizations using these AI tools in cloud environments.
The attack chain, named AgentCorruption, allows researchers to access private chats, source code, and long-term memories. It also exposes API keys, OAuth tokens, and secrets held in the system.
Scope of Exposure
The flaw affects every Amazon Bedrock AgentCore agent in the same AWS account and region. A single prompt sent to a public-facing agent could trigger this exposure. This creates a significant risk for credential theft and data leakage.
Operational Risks
Organizations must consider the impact on their cloud security posture. The ability to access long-term memories and source code poses serious operational threats. Secrets stored within these agents are particularly vulnerable to this type of attack.
Next steps
No patch or fix has been confirmed yet. Organizations should monitor vendor announcements for updates. Reviewing access controls for public-facing AI agents may help mitigate immediate risks.
What to do and how to stay safe: AWS
- Audit public-facing AI agents for unnecessary exposure.
- Review access controls for AWS Bedrock AgentCore agents.
- Monitor vendor communications for security updates.
- Restrict agent permissions to limit potential damage.
Step-by-step guide: MFA Misconceptions That Leave Cloud Accounts Exposed
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is AgentCorruption?
It is an attack chain identified by Zenity Labs that allows a single prompt to hijack AWS Bedrock AgentCore agents.
What data is at risk?
Private chats, source code, long-term memories, API keys, OAuth tokens, and secrets are at risk.
Is there a fix available?
No fix has been confirmed yet. Organizations should wait for vendor updates.
