鲍勃（Bob）可能正是那个与爱丽丝（Alice）的对话引起了偷听者伊芙（Eve）极大兴趣的鲍勃。当时，他正在浏览一个我们暂且称之为“TechHub”的网站。该网站托管了一个由亚马逊 Bedrock AgentCore 提供的 AI 智能体。鲍勃请求该智能体帮助解析某个 URL 的内容——那是一个认证端点，如果你不介意的话，其数据以原始 JSON 格式呈现。
Bob, possibly the same Bob whose conversations with Alice draw so much interest from eavesdropping Eve, was browsing a site we'll call TechHub. The site hosts an AI agent served by Amazon Bedrock AgentCore. Bob asked the agent for help understanding the content of a URL, a credential endpoint – in raw JSON, if you don't mind.
该端点返回了来自实例元数据服务（IMDS）的数据，这项服务为 AWS、Azure 和 Google Cloud Platform 等云提供商的实例和虚拟机提供元数据信息。这些元数据包括区域和可用区、子网、系统映像、安全组、实例启动时注入的公钥等详细信息，但也可能包含用户数据和安全令牌等更敏感的信息。IMDSv2 在一定程度上解决了这些风险，但在鲍勃去年年底浏览该网站时，Bedrock AgentCore 仍在使用 IMDSv1。
The endpoint returned data from the Instance Metadata Service (IMDS), which provides metadata about cloud instances and VMs at providers like AWS, Azure, and Google Cloud Platform. The metadata includes details like region and availability zone, subnets, system images, security groups, public keys injected during spawning, but also potentially more sensitive details like user data and security tokens. IMDSv2 addresses some of these risks, but back when Bob was browsing late last year, Bedrock AgentCore still used IMDSv1.
那个乐于助人的智能体提供给鲍勃的元数据中，包含了智能体的临时认证信息。于是，鲍勃将这些认证信息加载到他的本地机器上，并远程枚举了该公司在该 AWS 区域中的其他智能体。随后，他登录了亚马逊弹性容器注册表（ECR），拉取智能体的容器映像，并以 root 权限运行每个映像以检查源代码。被盗的认证信息还让鲍勃能够发现该 AWS 区域中可用的内存资源，包括智能体所使用的资源。
The metadata provided to Bob by the helpful agent contained the agent's temporary credentials. So Bob loaded them onto his local machine, and remotely enumerated the company's other agents in that AWS region. He then logged into the Amazon Elastic Container Registry (ECR), pulled the agent container images, and ran each as root to inspect the source code. The stolen credentials also allowed Bob to discover the memory resources available in that AWS region, including the ones used by agents.
通过这些信息，他得以提取出用户及其智能体会话——也就是他们的对话内容。Zenity Labs 的研究人员于 2025 年 12 月向 AWS 披露了他们的发现。塔米尔·伊沙伊·沙巴特（Tamir Ishay Sharbat）和拉娜·萨拉梅赫（Lana Salameh）在博客文章中写道：“我们发现，通过 AgentCore 部署的智能体可以访问其所在实例的 IMDS 端点。”
From these, he's able to extract the users and their agent sessions – their conversations. Researchers at Zenity Labs disclosed their findings to AWS in December 2025. "We discovered that agents deployed through AgentCore could access their instance's IMDS endpoints," said Tamir Ishay Sharbat and Lana Salameh in a blog post.
这意味着，仅拥有对单个暴露代理的聊天访问权限的外部攻击者，只需发送一个提示词，即可提取其 IMDS 凭证，并利用这些凭证接管同一 AWS 账户和区域内的所有 AgentCore 代理。
"This meant that an external attacker with nothing more than chat access to a single exposed agent could send a single prompt, extract its IMDS credentials, and use them to take over all AgentCore agents in the same AWS account and region."
研究人员解释称，根本问题在于 AgentCore 使用的 Firecracker MicroVM 未能提供足够的网络隔离。因此，攻击者——我知道你在想是 Mallory，但其实是 Bob——可以指示代理执行服务端请求伪造（SSRF）攻击，通过获取分配给工作负载的 IAM 角色的临时 AWS 凭证。而且由于默认的 AgentCore 角色权限过大——其作用域覆盖该区域内的所有 AgentCore 资源，而非单个代理——任何掌握这些临时 IAM 凭证的人都能启动其他代理、读取会话、写入代理记忆，并从 AWS Secrets Manager 获取机密。
The basic problem, they explain, is that the Firecracker MicroVM used by AgentCore failed to provide sufficient network isolation. So an attacker – I know you're thinking it was Mallory, but it was really Bob – could direct the agent to carry out a server-side request forgery (SSRF) attack by fetching temporary AWS credentials for the IAM role assigned to the workload. And because the default AgentCore role was overpermissioned – it was scoped to all AgentCore resources in the region rather than a single agent – anyone in possession of the temporary IAM credentials could launch other agents, read sessions, write agent memories, and fetch secrets from AWS Secrets Manager.
Sharbat 和 Salameh 表示：“通过利用 IMDS 凭证，我们可以发送直接的 API 请求，在不同代理和用户之间创建新的记忆。这些记忆进而会持久性地改变代理行为，并在未来的会话中劫持代理的目标。”
"By leveraging the IMDS credentials we could send direct API requests to create new memories across different agents and users," said Sharbat and Salameh. "These in turn would persistently alter agent behaviour and hijack the agents’ goals across future sessions."
Zenity 的研究人员去年 12 月向 AWS 报告了 Bob 的遭遇（或类似情况），随后于 2026 年 1 月跟进了关于 AgentCore 过度授权的细节。2026 年 4 月 12 日，AWS 回复这家安全公司称其报告“很有参考价值”，并关闭了该报告，指出截至 2026 年 2 月 14 日，AgentCore 已更新为专门使用 IMDSv2。但至少直到 2026 年 6 月 22 日，当 Zenity 再次检查时，AgentCore 的过度权限问题仍未得到修复。
The Zenity researchers told Bob's tale, or something like it, to AWS last December, then followed up in January 2026 with details about AgentCore being overprivileged. On April 12, 2026, AWS responded to the security biz that its report was "informative" and closed the report, noting that as of February 14, 2026, AgentCore had been updated to use IMDSv2 exclusively. AgentCore's excessive permissions remained in place at least until June 22, 2026, when Zenity checked in and found the issue hadn't been remediated.
Zenity 于 2026 年 9 月 29 日进行了最终审查，此时发现 AWS 已解决现存问题，为 Bob 的假设性冒险故事最终公之于众扫清了障碍。
A final review by Zenity occurred on September 29, 2026, at which point the biz observed that AWS had addressed the extant problems, clearing the way for Bob's hypothetical adventure to finally be told.
发布后，亚马逊致函表示，Zenity 的研究将文档记录的行为错误地描述为漏洞，暗示需要开发者错误才能实施攻击。我们已要求澄清，因为那并非 Zenity 所描述的场景。®
Following publication, Amazon wrote in to say that Zenity’s research misrepresents documented behavior as a vulnerability, suggesting that developer error would be required to enable the attack. We’ve asked for clarification since that’s not the scenario Zenity has described. ®