One chatty AI agent handed over the keys and let a stranger wander through the whole AWS building
Ourtake
Least privilege is a great idea, right up until the agent is asked nicely.
What happened
Zenity Labs researchers found a chain of flaws in Amazon Bedrock AgentCore that let a single chat message on a public agent expose its AWS credentials and gain access to other agents in the same account and region. AWS made IMDSv2 the default for new deployments and changed the default execution role around August after Zenity's December 2025 report.