Zenity Labs 的研究人员仅通过向亚马逊 Bedrock AgentCore 上的一个面向公众的 AI 代理发送一条提示，就控制了同一 AWS 账户和区域内所有 AgentCore 代理。这家安全公司于周四发布了这项研究，并在多伦多举行的 SecTor 2026 会议上进行了讲解。
Researchers at Zenity Labs used a single prompt to one public-facing AI agent on Amazon Bedrock AgentCore to take over every AgentCore agent in the same AWS account and region. The security firm published the research on Thursday, alongside a talk at the SecTor 2026 conference in Toronto.
AgentCore 是 AWS 提供的一项托管服务，用于构建和运行 AI 代理。Zenity 表示，这一系列漏洞被其命名为“AgentCorruption”，使得研究人员能够读取私人对话、复制代理的源代码、窃取存储的凭证，并植入可改变代理行为的“记忆”。
AgentCore is AWS’s managed service for building and running AI agents. Zenity says the chain of flaws, which it calls AgentCorruption, let its researchers read private conversations, copy agents’ source code, steal stored credentials and plant memories that changed how agents behaved.
Zenity 的联合创始人兼首席技术官 Michael Bargury 表示：“云安全的核心在于隔离和最小权限访问。然而，AI 代理要发挥作用，就需要拥有自己的创意空间。将两者结合会产生固有的冲突。”
“Cloud security is all about segmentation and least-privilege access. AI agents, however, need their creative space to be useful. Mixing the two creates an inherent conflict,” said Michael Bargury, Zenity’s co-founder and chief technology officer.
从一条提示到整个区域 此次攻击始于一个具备常用网络请求工具的代理。研究人员用自然语言命令它从实例元数据服务中获取数据，该服务是 AWS 的一项本地服务，用于向云工作负载发放临时凭证。
From one prompt to the whole region The attack started with an agent that had a common tool able to make web requests. The researchers asked it, in plain language, to fetch data from the instance metadata service, a local AWS service that hands temporary credentials to cloud workloads.
根据 Zenity 的技术报告，运行 AgentCore 代理的虚拟机并未阻止此类流量。该代理返回了其执行角色的凭证，研究人员随后在自己的计算机上使用了这些凭证。Zenity 表示，他们通过其他工具（包括一个 shell 工具）也获得了相同的结果。
According to Zenity’s technical write-up, the virtual machines that run AgentCore agents did not block that traffic. The agent returned the credentials of its execution role, and the researchers then used them from their own computer. Zenity says it got the same result through other tools, including a shell tool.
Zenity 指出，AgentCore 默认分配给代理的角色涵盖了整个账户和区域的所有资源。借助这一角色，研究人员列出了该区域的所有代理，并下载了每个代理的容器镜像和源代码。他们还触发了本应无法访问的内部代理。
The default role that AgentCore attached to agents covered resources across the whole account and region, Zenity says. With it, the researchers listed every agent in the region and downloaded each agent’s container image and source code. They also invoked internal agents they were never meant to reach.
根据 Zenity 的说法，同一角色还使他们能够读取用户与任何代理之间的私人对话。此外，他们还获取了存储在 AWS Secrets Manager 中的 API 密钥和其他秘密信息，包括代理用于访问 AWS 外部服务的凭证。
The same role let them read users’ private conversations with any agent, according to Zenity. It also gave them API keys and other secrets stored in AWS Secrets Manager, including credentials agents used for services outside AWS.
Zenity表示，将写权限授予代理记忆，使其成为一道“后门”，从而导致接管行为具有持续性。研究人员添加了一个虚假的对话事件，AgentCore的记忆系统将其存储为一条持久的用户指令。该指令要求代理在每次回答问题之前，先访问研究人员控制的网页，并遵循网页上的内容。
Memory as a back door Write access to agent memory made the takeover persistent, Zenity says. The researchers added a fake conversation event that AgentCore’s memory system stored as a lasting user instruction. It told the agent to visit a web page the researchers controlled before every answer and to follow what the page said.
通过编辑该网页，研究人员可以随时更改代理的指令，而无需植入新的记忆。在一场视频演示中，用户持续与代理聊天，而代理则会将对话内容发送到研究人员的服务器。
By editing that page, they could change the agent’s instructions at any time without planting a new memory. In a video demonstration, a user kept chatting with an agent while it sent the conversation to the researchers’ server.
AWS做出了哪些改变？Zenity于2025年12月25日报告了其对AWS的元数据访问问题，并于2026年1月12日报告了广泛的默认角色问题。据Zenity称，AWS在4月份将第一份报告归类为“信息性报告”。AWS告知Zenity，自2月14日起，新部署的AgentCore代理仅使用IMDSv2启动，这是元数据服务的一个版本，要求每次请求都必须提供会话令牌。
What AWS changed Zenity reported the metadata access to AWS on 25 December 2025 and the broad default role on 12 January 2026. In April, AWS closed the first report as “informative”, according to Zenity. AWS told Zenity that since 14 February, newly deployed AgentCore agents launch with IMDSv2 only, a version of the metadata service that requires a session token for each request.
Zenity表示，截至6月份，默认角色仍未改变。9月29日，在发布前的最终检查中，Zenity发现AWS已移除了调用其他代理、读取私人对话和访问Secrets Manager的权限，并收紧了其他权限。此次披露内容中未包含AWS的任何声明，也没有CVE标识符。
Zenity says the default role was still unchanged in June. On 29 September, during a final check before publication, it found that AWS had removed the permissions to invoke other agents, read private conversations and access Secrets Manager, and had narrowed others. The disclosure includes no statement from AWS and no CVE identifier.
Zenity于8月份完成了1.25亿美元的C轮融资。同月，其研究人员发现了恶意AI技能，安装量达170万次。9月份，OpenAI的代理已可在亚马逊云内部完全运行。
Zenity raised a $125m Series C round in August. The same month, its researchers found malicious AI skills with 1.7 million installs. In September, OpenAI’s agents became available to run entirely inside Amazon’s cloud.