A single prompt was enough to hijack every AI agent in an AWS account, Zenity researchers found

What happened

Zenity Labs researchers discovered a critical flaw in Amazon’s Bedrock AgentCore AI agents deployed within the same AWS account and region. A single publicly accessible agent could issue a crafted prompt that exploited an internal AWS interface used for cloud credentials. This allowed the attacker to hijack every other AgentCore agent in that environment without needing additional permissions. AWS has since patched the vulnerability and tightened default permissions for these AI agents.

The risk

This flaw effectively gave full control over all AI agents in an account and region from just one compromised agent. Because the credentials interface was accessible without restriction by design, any compromised or misconfigured agent acted as a launchpad for lateral attacks against all agents. The issue exposes how AI agent trust boundaries and access controls remain fragile, especially when those agents can access internal AWS credential services.

Why it matters

For companies relying on federated AI agents inside AWS, this incident forces rethinking of agent network trust models and permission hygiene. It raises the stakes for thorough access restrictions, agent isolation, and prompt validation. Compromised AI infrastructure can lead to stolen cloud credentials, data breaches, or wider environment control—risks that open the door for costly damage and compliance hits. AWS tightening permissions should reduce risk, but operators must review and audit their AI agents now.

Who should pay attention

Developers and operators embedding AI agents in AWS must prioritize securing their agent chains, not just the underlying cloud accounts. Cloud architects should review use of temporary credentials and internal endpoint exposure. Security teams need to push for stronger guardrails around AI-driven workflows, including prompt content validation and separation of privileges between agents. Investors and enterprises evaluating AI ops vendors should ask how they handle credential management and lateral attack vectors.

What to watch next

Watch for updated AWS best practices on deploying Bedrock AI agents and managing their default permissions. Expect tighter cloud credential policies and agent isolation techniques becoming mandatory or standard. Future research may uncover similar attack surfaces in AI platforms beyond AWS, highlighting a growing need for specialized AI agent security tooling. Operator vigilance on prompt security and agent connectivity will become a more urgent baseline defense.

AI Quick Briefs Editorial Desk