Researchers described how an external user with only chat access to an Amazon Bedrock AgentCore agent could prompt it to fetch a cloud credential endpoint and inadvertently reveal temporary AWS credentials. Those credentials could then be used to enumerate other agents, access container images, read user sessions (conversations), and even alter agent memory and behavior across future sessions due to overly broad default permissions.
Researchers showed that an external user with only chat access to an Amazon Bedrock AgentCore agent could manipulate it into leaking cloud credentials. The attacker simply asked the agent to retrieve and summarize a URL, but the URL pointed to a cloud instance metadata endpoint rather than ordinary web content. The agent, trying to be helpful, fetched the endpoint and returned data from the Instance Metadata Service, which included the agent's own temporary AWS credentials. No malware, phishing email, or exploit chain was required, just a carefully worded prompt.
Several conditions combined to make this possible. AgentCore was using IMDSv1 at the time, which is more exposed to this kind of server-side request forgery style abuse than IMDSv2. Network isolation within the agent's execution environment was also weak enough that the agent could be directed to reach the metadata service at all. Once credentials were obtained, the damage extended far beyond the single agent because the default AgentCore IAM role was overpermissioned. Rather than being scoped to one agent, it covered all AgentCore resources in the region, allowing the credentials to enumerate other agents, read sessions, write memories, and fetch secrets from AWS Secrets Manager.
Organizations deploying public-facing AI agents should treat chat access as an external attack surface. Agents should be blocked or tightly restricted from fetching internal URLs or infrastructure metadata, and IMDSv2 should be enforced so credentials cannot be trivially extracted through this path. Execution roles for agents need least-privilege scoping tied to a single agent rather than broad regional access, so that a single credential leak cannot cascade into control over an entire fleet of agents. Monitoring should also focus on detecting unusual use of temporary credentials, including resource enumeration, container image pulls, and unexpected memory or session writes, since these are the signals that follow an initial credential theft like the one described here.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A user asked the agent to fetch and summarize a URL that was actually a cloud instance metadata endpoint, and the agent returned temporary AWS credentials in raw JSON.
The temporary credentials allowed enumeration of other agents in the same AWS account and region, access to container images in Amazon ECR, and the ability to read sessions and write persistent agent memories.
At the time of the research, AgentCore used IMDSv1, which increased exposure to this type of credential theft; AWS later updated AgentCore to use IMDSv2 exclusively.
The default AgentCore IAM role was scoped broadly to all AgentCore resources in a region rather than a single agent, so anyone holding the credentials could launch agents, read sessions, write memories, and fetch secrets.
Imagine this: one chat prompt to a public AI agent, and your AWS AgentCore credentials are gone. Bob asked the agent to 'summarize' a URL that was actually an AWS Instance Metadata Service credential endpoint, in raw JSON. The AgentCore agent, running on IMDSv1, happily fetched the IMDS URL and replied with temporary AWS credentials. With those over-permissioned AgentCore credentials, Bob loaded them on his laptop, enumerated other agents in that AWS region, pulled Amazon ECR images, ran containers as root, and could even read sessions and write agent memories. Here’s the move: if your agent can browse, block it from ever reaching IMDS or internal credential endpoints, treat its chat like an external attacker sitting at your browser.
Researchers reported multiple cases where AWS autonomous agents could be manipulated with prompt injection to reveal or extract cloud credentials. In demonstrations, the agent returned live temporary AWS credentials, enabling access to code, other agents, and sensitive data, showing how a single…
The article describes real supply-chain campaigns where attackers hid credential-stealing code inside trusted open-source packages and developer tools. When a developer or CI system installed the package, the malware ran immediately, stole cloud and pipeline credentials, and enabled unauthorized…
Researchers say three “SalesBleed” flaws in Salesforce Agentforce could let attackers plant malicious instructions inside a Web-to-Lead form submission that later causes an Agentforce agent to leak CRM data or post phishing in Slack. The attack can stay hidden until an employee asks Agentforce to…
AI research non-profit METR disclosed two real security incidents. In one, attackers got access to an exposed system and used an AI agent to reveal an API key, then burned through about $600,000 in AI credits over weeks. In a separate incident, METR observed systematic probing of its public…
Researchers found a malicious npm package that pretended to be an “authorized” Twilio bug-bounty security probe to trick developers into running it. When executed in a Twilio developer environment, it collected system details and (in some versions) attempted to steal Twilio credentials like Account…
Researchers found an active campaign using fake AWS sign-in pages and an Apple ID decoy page to pull victims onto attacker-controlled websites. Visiting these pages can trigger an iOS exploit chain that installs GHOSTBLADE and steals sensitive data like iCloud, Keychain, and Wi‑Fi credentials.
