Amazon Bedrock Vulnerability Exposes Credentials and Code Access

Post Views: 1

Amazon Bedrock AgentCore had a security flaw allowing credential theft and code access through SSRF attacks.

Security Flaw in Amazon Bedrock Agent

A security flaw in Amazon Bedrock AgentCore, identified by Zenity Labs researchers, posed a risk of unauthorized access to temporary credentials and AI agent source code. The issue, present in earlier iterations of the system, could be exploited through a single input prompt, allowing adversaries to execute server-side request forgery (SSRF) attacks.

Vulnerability Overview

The vulnerability originated from the reliance on IMDSv1, a protocol that exposed temporary credentials associated with AI agents. Attackers could construct specific queries to trigger SSRF, thereby obtaining these credentials.

Exploitation Method

The compromised credentials, stemming from an overly permissive default IAM role configuration, granted unauthorized access to additional agents within the same AWS account and region. This included the ability to retrieve agent container images from Amazon Elastic Container Registry (ECR) and analyze their underlying code.

Impact and Risks

Furthermore, the stolen credentials provided access to user sessions and agent interactions stored in memory, expanding the potential attack surface. Zenity Labs reported the findings to AWS in December 2025, prompting remediation efforts.

Report and Remediation

The vulnerability highlighted risks inherent in AI agent architectures, particularly when default security configurations lack strict access controls. The incident underscores the importance of continuous monitoring and timely patching of cloud-native systems to prevent exploitation of misconfigured permissions.

Implications and Recommendations

The flaw also emphasized the growing complexity of securing AI-driven workflows, where compromised credentials could lead to cascading breaches across interconnected services. Organizations utilizing AI agents are advised to review IAM policies, enforce least-privilege principles, and implement additional safeguards to mitigate similar threats.

The vulnerability served as a critical reminder of the need for robust security practices in AI infrastructure, particularly as adoption of such technologies accelerates across enterprises.