Zenity researchers found that one prompt can hijack all AgentCore agents in an AWS account

Zenity Labs researchers disclosed a vulnerability chain named AgentCorruption, which only requires sending one prompt to a public Amazon Bedrock AgentCore agent to steal its AWS credentials via the metadata service 169.254.169.254, thereby controlling all AgentCore agents in the same account and region, reading private conversations, source code, and stored credentials, and also able to tamper with long-term memory.