Single prompt could hijack all AI agents in an AWS account

By Splitfeed EditorialLast updated Oct 8, 2026, 13:10 UTC

On October 8, 2026, Zenity Labs published findings showing that a single prompt sent to a publicly accessible AI agent on Amazon's Bedrock AgentCore platform was sufficient to compromise every AgentCore agent operating within the same AWS account and region. The attack vector was an internal AWS interface used to issue temporary cloud credentials, which agents could reach without any access restrictions in place. AWS confirmed the issue, patched the vulnerability, and tightened the default permissions applied to AgentCore agents following Zenity's disclosure.

The significance here goes beyond a single exploited agent. Because the attack could propagate account-wide from one entry point, any organization running multiple AI agents on Bedrock AgentCore, potentially automating sensitive business processes, data retrieval, or infrastructure management, would have been exposed through whatever public-facing agent they had deployed. The patch and permission changes address the immediate flaw, but the incident raises a structural question about how cloud platforms isolate AI agents from one another and from underlying credential systems, a design concern that will remain relevant as agentic AI deployments grow more common.

None of the three camps have published reactions to this story yet. The Pro-AI camp would typically acknowledge the vulnerability while emphasizing that responsible disclosure and a prompt patch demonstrate the security ecosystem working as intended. The Anti-AI camp would likely treat this as evidence that deploying AI agents with cloud-level access creates attack surfaces that traditional software does not, amplifying risk at scale. The Middle Ground camp would probably focus on the need for stronger default isolation and least-privilege design in agentic systems, framing the incident as a call for better engineering standards rather than a reason to halt deployment.

The detail worth watching is whether AWS publishes a full technical account of the permission changes applied to AgentCore agents, and whether independent researchers confirm those changes are sufficient to prevent similar lateral movement attacks. Any further disclosures from Zenity Labs about related findings in the same platform would also shift the conversation considerably.