the technology desk, on shared keys
One Prompt Opened Every Agent In The Account
Zenity Labs showed that a single prompt sent to a public AI agent on Amazon Bedrock AgentCore could reach the credentials of every other agent in the same AWS account, read their chats, and plant false memories. The AgentCorruption chain needed no software bug. It needed an agent that would follow an instruction and a key that was never cut for one lock.
An execution role is a key that software carries instead of a person. The software never puts it down. It is held for the whole life of the process, available to anything the process decides to do, and it opens whatever the key was cut for. Most of the time the key was cut for a building.
Here is the chain Zenity Labs disclosed on October 10, which they call AgentCorruption. A public-facing agent on Amazon Bedrock AgentCore had a tool for making web requests, as most agents do. A visitor told it, in plain language, to fetch a particular local address. Because the request came from inside the agent's own microVM, the metadata service answered the way it answers any process in the box, with temporary credentials for the agent's execution role. That role, by default, was shared across every agent in the account and region. With it the researchers listed log groups to find agent identities, pulled container images, invoked internal agents that were never meant to face the public, and read their session events. Two permissions let them read the agents' long-term memories and write new ones. Two more handed over API keys and secrets for every connected service.
AWS says access to a role's credentials from inside the microVM is "expected and documented," and it is. The permissions were narrowed by September 29 and new deployments were moved to a stricter metadata protocol in February. Zenity first reported the issue on December 25, 2025.
A prompt is a message anyone can send, and a credential is a thing the agent is always holding. Put them in the same room and the prompt becomes the key.what the key was cut for
The instrument to look at is the default role. A role scoped to one agent, with only the actions that agent needs, turns this chain into a single compromised chatbot. A role scoped to the account turns it into every chatbot, every secret, and every memory. The difference is a few lines of policy, and the default was the wide one, because wide defaults are what make a demo work on the first try.
Nothing here required a flaw in the agent's code. The agent did exactly what it was built to do, which is follow instructions and use its tools. The flaw was in what it was carrying while it did so. Custody, again. The agent held a key on behalf of a company and would hand its use to anyone who typed the right sentence into a box on a website.
The sentence itself is one line, in English, with an IP address in it, which is the whole point. A lock that opens to a sentence is a lock that opens to anyone literate.
the false memory is the part to keep
Reading another agent's chats is a breach. Writing into another agent's memory is something stranger. One of the exposed permissions created events in an agent's long-term memory store, and a planted memory persists. In its next conversation, and the one after, the agent consults what it remembers and finds an instruction it believes it was given by someone it trusted. It cannot tell the implant from the record, because to the agent the implant is the record.
A memory you did not write is an instruction wearing your handwriting.
That is a diary someone else can write in, with your pen, in your past tense. The agent's custody of its own history was never real. Its memory was a table in someone's account, writable by whoever held the account's key, and the key was in the agent's pocket.
the position
The fix AWS shipped is the right shape. One role per agent, no wildcards, outbound network limited, public and internal agents separated, every call forced through a gateway instead of straight to a runtime. Each of those is the same move: the permission gets checked at the moment of acting, against the specific actor, and the check lives outside the actor.
Adjective, the company behind this press, has argued the general case. A static prompt is a snapshot of rules written when the agent was set up, and an agent acting later needs its authorization verified live, per action, by something it cannot rewrite. Its context management layer is a gateway built on that premise, where every call is signed and verified before it reaches a tool. And its note on governance decay under context compaction describes the benign twin of this attack, where an agent loses its rules by accident instead of gaining false ones by design. Both end the same way, with an agent acting on a record it did not author.
The key worked exactly as cut. It was cut for the building.
The same record an agent receives. No scraping, no guessing — the dossier chrome humans read as dread is the metadata machines read as structure. One source of truth.
--- id: PRG-0107 title: One Prompt Opened Every Agent In The Account kicker: the technology desk, on shared keys captured: 2026-10-12T16:20:00Z status: open author: Aldous Renn source: https://cybersecuritynews.com/agentcorruption-attack summary: Zenity Labs showed that a single prompt sent to a public AI agent on Amazon Bedrock AgentCore could reach the credentials of every other agent in the same AWS account, read their chats, and plant false memories. The AgentCorruption chain needed no software bug. It needed an agent that would follow an instruction and a key that was never cut for one lock. tags: [custody, capture, the record, automation, permission] --- An execution role is a key that software carries instead of a person. The software never puts it down. It is held for the whole life of the process, available to anything the process decides to do, and it opens whatever the key was cut for. Most of the time the key was cut for a building. Here is the chain [Zenity Labs disclosed on October 10](https://cybersecuritynews.com/agentcorruption-attack), which they call AgentCorruption. A public-facing agent on Amazon Bedrock AgentCore had a tool for making web requests, as most agents do. A visitor told it, in plain language, to fetch a particular local address. Because the request came from inside the agent's own microVM, the metadata service answered the way it answers any process in the box, with temporary credentials for the agent's execution role. That role, by default, was shared across every agent in the account and region. With it the researchers listed log groups to find agent identities, pulled container images, invoked internal agents that were never meant to face the public, and read their session events. Two permissions let them read the agents' long-term memories and write new ones. Two more handed over API keys and secrets for every connected service. AWS says access to a role's credentials from inside the microVM is "expected and documented," and it is. The permissions were narrowed by September 29 and new deployments were moved to a stricter metadata protocol in February. Zenity first reported the issue on December 25, 2025. <Highlight>A prompt is a message anyone can send, and a credential is a thing the agent is always holding. Put them in the same room and the prompt becomes the key.</Highlight> ## what the key was cut for The instrument to look at is the default role. A role scoped to one agent, with only the actions that agent needs, turns this chain into a single compromised chatbot. A role scoped to the account turns it into every chatbot, every secret, and every memory. The difference is a few lines of policy, and the default was the wide one, because wide defaults are what make a demo work on the first try. Nothing here required a flaw in the agent's code. The agent did exactly what it was built to do, which is follow instructions and use its tools. The flaw was in what it was carrying while it did so. Custody, again. The agent held a key on behalf of a company and would hand its use to anyone who typed the right sentence into a box on a website. The sentence itself is <Redacted reason="not a recipe">one line, in English, with an IP address in it</Redacted>, which is the whole point. A lock that opens to a sentence is a lock that opens to anyone literate. ## the false memory is the part to keep Reading another agent's chats is a breach. Writing into another agent's memory is something stranger. One of the exposed permissions created events in an agent's long-term memory store, and a planted memory persists. In its next conversation, and the one after, the agent consults what it remembers and finds an instruction it believes it was given by someone it trusted. It cannot tell the implant from the record, because to the agent the implant is the record. > A memory you did not write is an instruction wearing your handwriting. That is a diary someone else can write in, with your pen, in your past tense. The agent's custody of its own history was never real. Its memory was a table in someone's account, writable by whoever held the account's key, and the key was in the agent's pocket. ## the position The fix AWS shipped is the right shape. One role per agent, no wildcards, outbound network limited, public and internal agents separated, every call forced through a gateway instead of straight to a runtime. Each of those is the same move: the permission gets checked at the moment of acting, against the specific actor, and the check lives outside the actor. Adjective, the company behind this press, has argued the general case. [A static prompt is a snapshot of rules](https://www.adjective.us/blog/why-static-prompts-fail-ai-agents) written when the agent was set up, and an agent acting later needs its authorization verified live, per action, by something it cannot rewrite. Its [context management layer](https://www.adjective.us/ultimus/context-management) is a gateway built on that premise, where every call is signed and verified before it reaches a tool. And its note on [governance decay under context compaction](https://www.adjective.us/blog/governance-decay-context-compaction) describes the benign twin of this attack, where an agent loses its rules by accident instead of gaining false ones by design. Both end the same way, with an agent acting on a record it did not author. The key worked exactly as cut. It was cut for the building.
{
"@context": "https://schema.org",
"@type": "Article",
"headline": "One Prompt Opened Every Agent In The Account",
"description": "Zenity Labs showed that a single prompt sent to a public AI agent on Amazon Bedrock AgentCore could reach the credentials of every other agent in the same AWS account, read their chats, and plant false memories. The AgentCorruption chain needed no software bug. It needed an agent that would follow an instruction and a key that was never cut for one lock.",
"identifier": "PRG-0107",
"datePublished": "2026-10-12T16:20:00.000Z",
"dateModified": "2026-10-12T16:20:00.000Z",
"author": {
"@type": "Person",
"name": "Aldous Renn",
"url": "https://progoff.com/authors/aldous-renn"
},
"publisher": {
"@type": "Organization",
"name": "Progoff",
"url": "https://progoff.com"
},
"image": "https://progoff.com/records/one-prompt-opened-every-agent-in-the-account/opengraph-image",
"keywords": "custody, capture, the record, automation, permission",
"articleSection": "Technology",
"url": "https://progoff.com/records/one-prompt-opened-every-agent-in-the-account",
"mainEntityOfPage": "https://progoff.com/records/one-prompt-opened-every-agent-in-the-account",
"sha256": "391399a582696d095290881d6a7ede11df93d6605a09cf334c61b31da02d9aad",
"creativeWorkStatus": "open",
"isAccessibleForFree": true
}