Zenity Labs published an October 8 security-research report about issues it found in Amazon Bedrock AgentCore. The report begins by saying all the described security issues have been patched by AWS and the underlying issues addressed. It is a disclosure of earlier findings, not evidence that the same attack remains available today.
The researchers describe how a deployed agent could reach its workload's instance-metadata service and return temporary credentials. An agent's ability to fetch content therefore became a route to sensitive cloud credentials. The report concerns the tested deployment and permissions, rather than proving that every cloud-hosted agent exposes credentials.
The report also describes an overly broad default execution role. In the researchers' tests, the credentials could reach other AgentCore resources in the same AWS account and region, including agent sessions and memory. That account-and-region scope should not be presented as access to every AWS customer's data.
Zenity says it reported the metadata issue in December 2025 and the default-role findings in January 2026. Its disclosure timeline says AWS moved AgentCore to use IMDSv2 only as of February 14. The researchers say a June 22 check still found broad permissions in the default role.
At a final September 29 review before publication, Zenity observed substantial restrictions to that default execution role, including removal of permissions for broad agent execution, private-conversation reads and secrets access across the account's region. Those dated findings explain why the October publication describes the issues as patched.
AWS disputes the characterization in a statement included in the report: it says the described behavior is documented and expected, and that agents can access credentials for their own execution role. AWS says access to another account requires explicit permissions on both sides and recommends limiting each role to the permissions its agent needs. That response should be read alongside the researchers' account of the earlier default permissions.
Limits: these are the researcher's findings and remediation timeline, not an independent audit of every customer configuration. The report does not announce a confirmed customer breach or quantify affected victims. This brief omits exploitation instructions and does not treat historical test access as evidence of a current compromise.