# One Prompt Exposed Every Agent in Its Region Under AWS's Old AgentCore Default

_Zenity Labs reported on October 8, 2026, that one prompt to an exposed Amazon Bedrock AgentCore agent returned the credentials of its default role. That role covered every AgentCore agent in the account's region, their private conversations and their stored secrets. AWS has since narrowed it._

By Johannes Keienburg, CEO & Founder  
Published: 2026-10-13  
Source: https://www.cakewalk.security/blog/aws-agentcore-default-role-every-agent

---

## The Default Role Covered Every Agent in the Account's Region

Companies can deploy their AI agents on Amazon Bedrock AgentCore, a managed AWS platform. On October 8, 2026, the security firm Zenity Labs showed that one prompt to a single AgentCore agent could expose all the others. The attacker used a [prompt injection](/glossary/prompt-injection) to make an agent with a web-request tool call the instance metadata service. This local AWS endpoint hands out the temporary credentials of the agent's cloud role. By default, that role was not limited to its own agent. It held permissions over every AgentCore agent in the same account and region. [Least privilege](/glossary/least-privilege) exists to close exactly that gap.

> The default AgentCore role wasn't scoped to the specific agent. Instead, it included broad permissions across all AgentCore resources in the entire AWS account's region.

_Tamir Ishay Sharbat and Lana Salameh, Zenity Labs_

With those credentials, the researchers listed every agent in the region. They could read private conversations across agents, users and sessions and send requests to any agent, including internal ones. Zenity Labs says an attacker needed only chat access to one exposed agent. AWS says an agent can access another AWS account only if the developer grants permissions on both sides. Inside AWS, the [blast radius](/glossary/blast-radius) therefore stayed within one account and region. Stolen credentials have carried an agent further before. In the [JadePuffer attack](/blog/jadepuffer-agentic-ransomware) reported in July, an agent used them to move through a network on its own.

## The Credential Store Was Readable by the Agent It Was Kept From

AgentCore recommends keeping an agent's credentials for [MCP servers](/glossary/mcp-server), connectors and APIs away from the agent itself. They go into AgentCore Identity and AWS Secrets Manager. AgentCore Gateway then adds them to the requests that pass through it. The default role held permission to read those secrets in Secrets Manager. In a follow-up post, the researchers used them to access services outside AWS. A gateway that holds credentials for an agent protects them only while the agent's cloud role cannot read the store that holds them.

> The behavior described is documented and expected. AgentCore agents can access the credentials for their own execution role through the metadata service.

_AWS, statement published by Zenity Labs_

Zenity Labs reported the findings to AWS in December 2025 and January 2026. AWS told the researchers that newly deployed agents have used only the newer version of the metadata service, IMDSv2, since February 14, 2026. On September 29, 2026, the researchers found that AWS had removed the default role's region-wide permissions to run agents, read conversations and access Secrets Manager. Zenity Labs says all the issues it describes have been patched, although AWS calls the behavior documented and expected. Its post does not say whether agents deployed before these changes were updated. AWS recommends execution roles that hold only what their agents need.

> An agent acts for a named person, and its access should stay at the least it needs. Here one prompt turned a single agent's cloud role into access to every agent in its region. A request to the metadata service does not pass through the MCP Gateway. For the calls it does govern, the gateway checks each one against policy and injects the upstream credential on its own side. It records whether each call was allowed, denied or escalated. Outside it, someone has to check which role each agent runs under and whether that role covers that agent alone.

_Comment from Gil Röder, CPO & Co-Founder_

Source: Tamir Ishay Sharbat and Lana Salameh, Zenity Labs, [AgentCorruption: How A Single Prompt Collapsed The Entire Cloud Security Model](https://labs.zenity.io/post/agentcorruption-how-a-single-prompt-collapsed-the-entire-cloud-security-model), October 8, 2026.