Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In September 2025, Sonrai Security reported that code running in a sandboxed Amazon Bedrock AgentCore Code Interpreter could reach the interpreter’s MicroVM Metadata Service (MMDS) and retrieve its temporary AWS execution-role credentials. AWS documentation confirms that code or an actor inside the VM can access those credentials, regardless of Code Interpreter network mode. The finding concerns a specific AgentCore credential path—not every Amazon Bedrock agent.
How the credential exposure worked
AgentCore uses the MicroVM Metadata Service to provide temporary credentials to execution roles used by services including Code Interpreter, Runtime, and Browser. In its September 4, 2025 report, Sonrai Security described accessing the Code Interpreter’s MMDS endpoint from sandboxed code and retrieving the interpreter’s temporary credentials. The report said simple string filtering could be bypassed; it did not establish that network sandboxing was a reliable credential boundary.
AWS’s documentation, Understanding Credentials Management in Amazon Bedrock AgentCore, independently warns: “any code or actor running inside the VM can access these credentials by calling the metadata endpoint.” AWS also says this credential path applies independently of Code Interpreter network mode. That means network isolation alone should not be treated as protection against code inside the VM accessing the role credentials.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Credentials are temporary, but an actor who obtains them may be able to use the permissions assigned to the execution role outside the interpreter. The potential impact therefore depends on that role’s actual permissions and on who can invoke the resource. The report does not show that every Bedrock agent was compromised, nor does it establish a general arbitrary-code vulnerability across Amazon Bedrock.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How to assess and reduce exposure
AWS recommends least privilege for each AgentCore execution role and says the role should have equal or fewer privileges than the users able to invoke its resource. Apply that guidance to the components and resources in your own deployment:
- Inventory the AgentCore components you use. Identify Code Interpreter, Runtime, Browser, and any other AgentCore resources, along with the execution role associated with each. AWS says each service requires its own execution-role permissions.
- Review each role’s effective permissions. Compare the granted actions and resources with what that service actually needs. Remove permissions that are unnecessary, overly broad, or unrelated to the resource’s expected use.
- Check who can invoke each resource. Verify that users or workloads able to invoke it cannot obtain a more privileged execution context than their own access warrants.
- Do not rely on a network-mode change as the credential fix. AWS says MMDS access to execution-role credentials is independent of Code Interpreter network mode.
- Investigate any suspected credential exposure. Review the execution role’s permissions and the role’s use in the context of your organization’s normal AWS monitoring and incident-response process. The sources cited here do not prescribe a universal customer-side patch for the specific 2025 MMDS behavior.
AWS’s guidance is to “Follow the principle of least privilege when configuring the execution role permissions.” The practical priority is limiting what credentials can authorize, rather than assuming that sandbox network settings alone prevent code in the VM from reaching the metadata endpoint.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Do not confuse this report with later AgentCore advisories
Two separate AgentCore issues were disclosed in 2026. They affect different components and have different remedies; neither is the 2025 MMDS credential path.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall| Issue | Component and reported impact | Remediation stated by AWS |
|---|---|---|
| Starter Toolkit import vulnerabilities: CVE-2026-105812 and CVE-2026-106032 | AWS Security Bulletin 2026-127-AWS, October 6, 2026, says bedrock-agentcore-starter-toolkit versions 0.1.4 through 0.3.13 were affected. The issues involved code injection during import and external-reference handling that could cause network requests or local file access during import. |
AWS says version 0.3.14 addresses the issues. Affected agents need to be re-imported with version 0.3.14 or later, and local and deployed output artifacts replaced. AWS says the toolkit was deprecated on March 27, 2026, and points users to the AgentCore CLI replacement, which it says contains the equivalent fix. |
| Harness tool-invocation validation issue: CVE-2026-18830 | AWS Security Bulletin 2026-073-AWS, August 4, 2026, says an authenticated user could use the InvokeHarness API, before July 31, 2026, to cause tools configured on a harness to run without model mediation by supplying a tool-use content block in the final message. | AWS says it added server-side input validation and no customer action is required. The stated impact was limited to tools configured on the affected harness. |
These bulletins describe an import-tool chain flaw and a harness tool-dispatch flaw, respectively. Their versioned or server-side fixes should not be read as proof that the separate MMDS credential path has a universal customer-side patch.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
When per-user credential scoping applies
AWS documents per-user credential scoping in AgentCore Identity’s Token Vault, but says it is available only when callers authenticate using a Bearer JWT through the OAuth inbound path. That is a condition for that specific Identity configuration; it does not identify AgentCore Identity as the cause of the Code Interpreter credential exposure.
Quick Recap
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
