AgentCorruption: patched AWS Bedrock AgentCore prompt-injection flaw

AgentCorruption is a prompt-injection chain against Amazon Bedrock AgentCore, demonstrated by Zenity Labs. A single malicious prompt delivered through an exposed AI chatbot exploits overprivileged execution roles attached to agent metadata access, pivoting from conversation input to credential theft, memory poisoning, conversation exposure, and lateral movement across agents within the same AWS account and region. The flaw was patched by AWS before the 2026-10-09 reporting wave, but the architecture remains exposed for any organization that did not apply the update promptly or did not restrict agent execution privileges.

The exposure is structural, not cosmetic. Because Bedrock AgentCore grants agents broad AWS permissions to function, a compromised agent does not stop at data leakage; it acquires the execution role's credentials and can move laterally to other agents in the same region, turning a single chatbot prompt into full environment control. This matters more than a conventional application vulnerability because the entry point is user-generated text rather than a malformed packet, meaning standard WAF and input-sanitization rules miss the trigger entirely. Organizations running AgentCore in multi-agent configurations face compound risk: memory poisoning lets an attacker alter agent behavior persistently, not just steal data once.

Defenders should verify the AWS patch is deployed across all AgentCore instances in the account, then audit every agent execution role for overprivileged metadata and cross-agent permissions. Restrict agent-to-agent communication within the same account and region to the minimum required, and review conversation logs for unexpected credential-access patterns or abnormal metadata reads. Hunt for IoCs linked to this chain: sudden agent role assumption changes, anomalous access to agent memory stores, and prompts containing embedded payload instructions such as <img src=x> style markup injected into chatbot inputs. Monitor the three reporting sources (darkreading.com, gbhackers.com, cyberupdates365.com) for updated telemetry since the disclosure is recent.

Watch for two shifts: confirmation of in-the-wild exploitation beyond the Zenity Labs proof-of-concept, and any AWS advisory that names specific AgentCore build or patch versions. If either appears, the assessment moves from architectural risk to confirmed active threat requiring emergency role revocation rather than routine patching.