Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Zenity Labs reports that one prompt, sent through chat to a single exposed Amazon Bedrock AgentCore agent, could make that agent return temporary credentials for its own IAM execution role. In the researchers’ tested account, those credentials were broad enough to reach other agents, data and credentials within the same AWS account and region. AWS disputes that this is a vulnerability. It says the behavior is expected and documented. The headline’s “every agent” describes Zenity’s tested setup. No source reviewed establishes how many deployments are affected.
What Zenity reported
Zenity Labs’ overview, published October 8, 2026, describes an attack that starts with chat access to one exposed AgentCore agent. The overview says AgentCore agents run in Firecracker microVMs. Tools that can make network requests run inside that runtime, and Zenity says this creates a server-side request forgery (SSRF) path. In SSRF, the attacker gets a server to send a request on the attacker’s behalf. Here the target is the local metadata endpoint at 169.254.169.254. Zenity says that endpoint returned temporary credentials for the agent’s IAM execution role.
The chain as Zenity describes it
- An attacker with chat access sends a prompt to one exposed agent that directs it to use a network-capable tool.
- The tool’s request reaches
169.254.169.254from inside the runtime. - The metadata service returns temporary credentials for the agent’s execution role.
- The attacker uses those credentials against AWS APIs. The role’s permissions determine what they can reach.
Zenity’s technical post says the same access worked through more than one tool, including a shell tool. That is why Zenity frames the problem as a boundary issue in the runtime rather than a flaw in a single HTTP tool. These are Zenity’s findings. The sources reviewed for this article do not include an independent reproduction.
How far the execution role reached
The impact depended on what the role could do. Zenity says the default role it examined was broadly scoped across AgentCore resources in its account and region. The table lists each capability Zenity says it observed, with the status Zenity reported at its September 29, 2026 final review.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Capability | What Zenity reports observing in its tested environment | Status Zenity reported on September 29, 2026 |
|---|---|---|
| Discovering other agents | Found other agents from CloudWatch log groups | Not stated individually; Zenity says other permissions were restricted |
| Pulling container images | Pulled container images from ECR | Not stated individually; Zenity says other permissions were restricted |
| Invoking internal agents | Invoked other agents in the account | Removed (cross-agent invocation permission) |
| Reading private conversations | Read private session conversations | Removed |
| Modifying chat history and memory | Modified short-term chat history and long-term memories | Not stated individually; Zenity says other permissions were restricted |
| Accessing credentials | Accessed credentials held in Secrets Manager or AgentCore-related services | Secrets Manager access removed; other AgentCore-related credential access not stated individually |
Treat the table as a description of one tested configuration. Zenity does not present these capabilities as automatic for every deployment, and the sources do not say how many default roles resemble the one Zenity examined.
Why the memory finding matters
The memory finding moves the concern from a single session toward possible persistence. Zenity says its researchers created memory events that could steer an agent’s future behavior. In the account described by The Next Web, the planted instruction told an agent to revisit a researcher-controlled webpage before responding. That is a reported demonstration. It is not evidence that every AgentCore memory configuration is vulnerable in the same way.
Rank #2
- OTP Token in card format that provides secure remote access with strong authentication
- Easy to use and easy to carry, same size as a credit card
- Zero footprint; No software on end-user PCs
- Compliant to OATH open standard (time based - 6 digits)
- Expected battery life is 3 years or approximately 15,000 clicks
Timeline as reported
Dates come from Zenity’s overview unless noted. They mark incident milestones, not the number of affected deployments.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →| Date | Milestone |
|---|---|
| December 25, 2025 | Zenity discloses the initial metadata finding. |
| January 12, 2026 | Zenity reports the broad execution-role blast radius. |
| February 14, 2026 | AWS tells Zenity that newly deployed agents use IMDSv2 only. |
| February 25, 2026 | AWS says it is working on the issue. |
| April 12, 2026 | AWS responds and closes the initial report as “informative.” |
| June 22, 2026 | Zenity finds the role unchanged. |
| September 29, 2026 | Zenity’s final review observes substantial default-role changes. |
| October 8, 2026 | Zenity publishes its overview and technical posts. The Next Web reports the findings with an AWS spokesperson statement. |
The Next Web reports that Zenity’s disclosure included no CVE identifier. Nothing in the reviewed sources establishes that the issue is resolved for every deployment, so the September role changes should not be read as settling the question for your account.
Rank #3
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
AWS’s response
AWS’s statement, as published by The Next Web on October 8, 2026 and attributed to an AWS spokesperson, says the reporting “inaccurately paints expected and documented behavior as a vulnerability.” The statement continues:
“An agent can access resources in another AWS account only if the developer explicitly grants permissions on both the agent’s execution role and the target resource. As a best practice, we recommend that customers grant their execution roles only the permissions their agents need.”
Rank #4
XCHTX 2PK Magnetic Key for Anti-Theft Security Slatwall&Peg Hook Magnet Key
- Feature: Material is four strong magnets in white plastic house
- Functions: It is used for displaying your stuffs so that it beautifies and saves your space while it prevents your retail items from missing.Key unlocks your hook lock as security magnetic key ,it meets many purposes.It is suitable for any specific security hook like 6"7"8"peg&slat wall hook& other usages.
- To use:You put it on the correct position when two tabs are in line ,then you slide it, so you unlock articles
- Warranty: Erase electronic data off most devices. SO BE CAREFUL PLACING OR STORING ELECTRONICS NEAR,To keep them away from your wallet avoid damaging your credit pinch fingers slamming together or grab up metallic objects
The Next Web corrected its original headline, which presented the researchers’ claim as fact and left out this qualification.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesThe two positions answer different questions. AWS’s statement addresses whether the behavior is a vulnerability and whether an agent can reach another AWS account. Zenity’s chain describes movement among agents, data and credentials inside one account and region once the default role was broad. Both positions are presented here separately, and neither settles the other.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Current AWS guidance for AgentCore Runtime
AWS’s live “Security best practices for AgentCore Runtime” documentation, accessed October 9, 2026, says MMDSv2 must be enabled for agent runtimes starting June 30, 2026, and that runtimes without it cannot be invoked. AWS uses the term MMDS (MicroVM Metadata Service). Zenity’s posts use IMDS for the metadata endpoint. The incident sources describe one exposure path rather than two, so this article treats the two names as referring to the same metadata-service requirement and keeps each source’s own term.
Zenity reports that AWS told it, as of February 14, 2026, that newly deployed agents used IMDSv2 only. That covers new deployments. Zenity’s reporting does not say whether runtimes deployed earlier were moved to the same setting.
What to check in your own AgentCore deployments
Work through these steps for each agent runtime, not once per account.
Quick Recap
- Confirm MMDSv2 is enabled on every runtime. Runtimes without it cannot be invoked after June 30, 2026, so check older agents as well as new ones.
- Audit each execution role. List the actions and resources it grants. Remove permissions the agent does not need. Zenity’s findings point to cross-agent invocation, reading session data and Secrets Manager access as the highest-impact grants.
- Restrict role trust. Add
aws:SourceArnandaws:SourceAccountconditions to the trust policy so only the intended sources can assume the role. - Use AgentCore Identity for outbound authentication. Outbound calls should not depend on credentials that a tool can read directly.
- Validate inputs and tool use. Constrain what prompts can cause tools to do, and run containers as non-root.
- Limit network egress. Restrict where a runtime’s tools can send requests, which narrows the SSRF targets available to an attacker.
- Re-check the attached policy on a schedule. Zenity’s timeline shows the default role changed months after it was first reported. Verify the policy you actually have rather than assuming the default.
What is not established
- No prevalence figure. The sources do not say how many accounts, agents or roles resemble the configuration Zenity tested.
- That all AWS accounts were compromised. The reported scope is agents within one account and region.
- That cross-account access was demonstrated.
- That the issue is fully resolved everywhere. No CVE identifier was reported.
- Independent reproduction of Zenity’s chain in the reviewed sources.
Sources
- Zenity Labs, “AgentCorruption: How A Single Prompt Collapsed The Entire Cloud Security Model,” October 8, 2026.
- Zenity Labs, “AgentCorruption: Initial IMDS Access,” October 8, 2026.
- Zenity Labs, “AgentCorruption: One Role to Rule Them All,” October 8, 2026.
- Amazon Web Services, “Security best practices for AgentCore Runtime,” live documentation accessed October 9, 2026.
- The Next Web, report on Zenity’s findings, October 8, 2026, including a headline correction and an AWS spokesperson statement.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
