Researchers at Zenity Labs disclosed in December 2025 that AWS's AgentCore service contained a security weakness allowing temporary credentials to be extracted via the Instance Metadata Service (IMDS). The flaw stemmed from the Firecracker MicroVM used by AgentCore failing to provide adequate network isolation. When an external actor with access to a single exposed agent sent a crafted prompt, the agent would retrieve temporary AWS credentials for its assigned IAM role. These credentials, which were scoped to all AgentCore resources in the region rather than individual agents, could then be used to enumerate and take control of other agents within the same account and region.

The extracted credentials enabled attackers to perform several actions: listing other agents in the region, pulling container images from the Amazon Elastic Container Registry, executing them with root privileges to inspect source code, and accessing memory resources to retrieve conversation histories between agents and their users. Researchers noted that these capabilities could persistently alter agent behavior and hijack future interactions across sessions.

AWS initially responded to the disclosure by describing the findings as "informative" and closed the report on April 12, 2026, stating that AgentCore had been updated to use IMDSv2 exclusively as of February 14, 2026. However, researchers indicated that excessive permissions remained unaddressed until June 22, 2026, when further validation confirmed the issue had not been fully remediated. A final review on September 29, 2026, observed that AWS had implemented necessary fixes.

Following publication, Amazon contested the characterization of the issue as a vulnerability, suggesting that the described attack scenario required specific developer configurations. Researchers maintained that the documented behavior enabled the attack as described without requiring extraordinary conditions. The incident highlights ongoing challenges in securing AI agent architectures within cloud environments, particularly regarding credential scoping and inter-agent isolation.