AWS Bedrock AgentCore Flaw Allowed Attackers to Hijack AI Agents Using a Single Prompt

A disclosure of "AgentCorruption" details how Amazon Bedrock AgentCore containerized agents can be instructed via malicious prompts to contact the MicroVM metadata endpoint (169.254.169.254), retrieve temporary execution-role credentials, and use them to access other agents, secrets, logs, and conversations; researchers demonstrated credential exfiltration and lateral use of AWS APIs, and AWS subsequently restricted metadata behavior and execution-role permissions—highlighting the need for least-privilege IAM for agent runtimes.