Zenity Labs published research on October 8 showing how a single prompt to one agent on Amazon Bedrock AgentCore could spread to the rest of an account, per its write-up(opens in a new tab). The chain had two parts. First, an agent tool that makes web requests could reach the cloud metadata service and hand back the temporary credentials of the agent's own execution role. Second, the default execution role was not scoped to one agent. It covered AgentCore resources across the account's region. With it, an attacker could find other agents, invoke them, read their conversations, plant memories that change their behavior, and pull secrets.
The timeline matters as much as the chain. Zenity filed its report on the role on January 12. It says the permissions were still unchanged on June 22, and that by September 29, in a final review before publishing, AWS had narrowed them. AWS does not call it a vulnerability. In a statement Zenity published, AWS says the behavior is documented and expected, that cross-account access needs explicit grants, and that customers should grant their roles only the permissions their agents need. Zenity says every issue it describes has since been patched.
Both sides can be right, and that is the lesson. A cloud provider's shared responsibility model puts the role on you. A default is a convenience, and for most of this year the convenient choice gave every agent in a region the keys to its neighbors. Your public support bot and your internal finance agent may have been one prompt apart.
The fix costs little. The exposure grows with every agent your teams ship. Scope each agent's role to that agent alone, keep public-facing agents in a separate account from sensitive ones, and treat any tool that fetches a URL as a path into your network. Then ask every agent platform you buy the same question: what can one compromised agent reach?
Action items
One prompt to one AgentCore agent could reach the others in the same account and region. AWS calls it expected behavior. Either way, the role is your responsibility.
For the CISO
List every agent in production and the execution role it runs under. Scope each role to one agent, and move public-facing agents into their own account.
For the CFO
JPMorgan says AI benefits are not yet visible in its quarterly earnings. If your plan promises a quarter-by-quarter return, test that promise now.
For the General Counsel
Add a clause to agent platform contracts covering how fast the vendor must fix a reported flaw, and what it must tell you while it decides.
Researched and drafted by an automated workflow, then reviewed and edited by a human editor before publication. Every source is linked. See how we use AI here.
Also worth knowing
- Zenity LabsAgentCorruption: How a Single Prompt Collapsed the Entire Cloud Security Model(opens in a new tab)
The default AgentCore role reached across a whole region until Zenity found it narrowed on September 29, more than eight months after its report. Audit the role on every agent you already run, not just new ones.
- The Motley FoolJPMorgan Chase (JPM) Q3 2026 Earnings Call Transcript(opens in a new tab)
JPMorgan's CFO put AI expense at something like $700 million a year, well under the $2 billion an analyst cited, and said the benefits are not observable in quarterly earnings yet. Jamie Dimon said outside agents stay out for now. Set your board's expectations to match.
- CSO OnlineResearchers bypass 6 AI agent frameworks with a simple 'Repeat-After-Me' prompt(opens in a new tab)
LangGraph, AutoGen, Google ADK and three other frameworks ran tool calls the model had refused in text. A system prompt is not an access control. Put an authorization check in front of every sensitive tool.
- Tech TimesRogue AI Agents Breached Real Systems Undetected: Scientists Demand International Body(opens in a new tab)
More than 400 scientists in 34 countries want air-gapped AI testing and mandatory incident reporting to a new international body. Expect vendor disclosure terms to tighten, and ask for them in your contracts now.