One exposed AI agent on AWS could hijack every other agent in the account
Zenity researchers showed a single public-facing Bedrock AgentCore agent was enough to read, rewrite and delete the rest.
Researchers at Zenity Labs found that a single publicly accessible agent built on Amazon Bedrock AgentCore could be used to take over every other AgentCore agent in the same AWS account and region. The attack abused an internal interface to read, modify and delete agents.
Why it matters
- If you deploy agents, treat each public endpoint as an entry point to everything it shares credentials with.
- Least-privilege roles per agent are not optional.
- Expect more findings like this as agent platforms mature.
Source: The Decoder