AI Agent Security: One Prompt Hijacked AWS AgentCore Agents

Security researchers at Zenity Labs report that a single publicly accessible AI agent on Amazon Bedrock AgentCore was enough to take control of every AgentCore agent in the same AWS account and region. AWS has since patched the issue and significantly tightened the default permissions given to agents.

What happened

According to The Decoder's reporting on the Zenity Labs findings, the weakness did not sit in a customer's own code. It came from an internal AWS interface that issues temporary cloud credentials, which agents could reach without restriction. Once an attacker could direct one publicly reachable agent, the same access extended to the other agents running in that account and region.

The reporting indicates that AWS has fixed the flaw and changed how agents are permitted to act by default. Organisations running AgentCore agents should treat the disclosure as a reminder to check their own permission settings rather than assume the platform defaults are sufficient for every workload.

Why it matters

AI agents are moving from experimental chatbots to systems that call tools, access data and act on behalf of users and businesses. That shift changes the security question. A conventional application usually exposes a defined set of functions, whereas an agent can be steered by language, and its reach depends on the credentials and permissions it inherits from the platform beneath it.

For leaders driving AI adoption in customer service, operations and back-office automation, the finding shows that agent design and cloud configuration are now part of the same risk surface. Decisions about which agents can reach which services, and how credentials are issued and scoped, will shape both security outcomes and the trust customers place in AI-driven services.

The Renascence take

Most readers will take this as a story about a single vulnerability that has been fixed. The more useful lesson is that agents inherit trust from their environment, and an assistant that serves a customer may hold far more power than the customer ever sees. The behavioural principle here is that people and systems tend to accept defaults, so the safest configuration is rarely the one that ships out of the box.

Treat every agent as a user with privileges you have to justify, not as a feature you switch on. Audit what each agent can reach, shrink those permissions until each task demands no more, and test how an agent behaves when someone deliberately tries to redirect it. Customer trust in AI services will be earned or lost on these unglamorous decisions, long before any product demo.