AWS AgentCore security undone by prompt requesting credentials

Researchers at Zenity Labs disclosed that Amazon Bedrock AgentCore (using Firecracker MicroVMs) exposed instance metadata via IMDSv1 to hosted agents, enabling an attacker who can prompt an agent to trigger an SSRF to retrieve temporary IAM credentials. Because the default AgentCore role was overly permissive, those credentials could be used to enumerate and hijack other agents in the same AWS account/region, pull container images, read user sessions and memories, and access secrets; AWS later moved to IMDSv2 and addressed the issues after coordinated disclosure.