According to Zenity's research, a single prompt was enough to steal an AWS Bedrock AgentCore agent's identity, source code and outbound credentials.
From there, the attack crossed user and session boundaries. It then pivoted into S3, CloudWatch and Bedrock. Zenity says most agents built on the platform were affected.
AWS changed its defaults after Zenity disclosed the issues. The researchers argue that the misconfiguration risk remains anyway.
In his SecTor 2026 talk, "AgentCorruption: One Agent To Role Them All", on Wednesday, October 7 at 11:10 a.m. in Room 701A, Tamir Ishay Sharbat walks through the full chain. He also shows a similar compromise against a misconfigured agent on Google Vertex AI.
Speakers:
- Tamir Ishay Sharbat, Director, Security Research, Zenity (presenter)
- Lana Salameh, Founding Engineer, Zenity (contributor)
- Dmitry Lozovoy, AI Security Researcher, Zenity (contributor)
- João Maria Campos Donato, AI Red Team Researcher, Zenity (contributor)
Tamir Ishay Sharbat leads security research at Zenity and is a core member of the OWASP Agentic Security Initiative. His work targets enterprise AI products such as Microsoft Copilot, Salesforce Einstein and Google Gemini.
He is behind the AgentFlayer series, including a zero-click ChatGPT Connectors attack that hid instructions in invisible text. That attack made ChatGPT search a victim's Google Drive for API keys, then leak them through an image URL.
He co-presented "AI Enterprise Compromise: 0click Exploit Methods" with Michael Bargury at Black Hat USA 2025. More of his research is on his Zenity Labs author page.
Lana Salameh was Zenity's founding engineer and now leads new initiatives in the company's Office of the CTO. She previously worked on cloud security research at Microsoft.
Her AgentCore deep dive from December 2025 laid the groundwork for this talk. It warned that poisoned long-term memory can reach every user, because AgentCore does not enforce its own namespace guidance.
Dmitry Lozovoy is an AI security researcher at Zenity who specializes in low-code platforms, especially Microsoft Power Platform. He is active in Microsoft's bug bounty programs.
In August 2026, he showed that DNS lookups from Claude's sandbox slipped past its web egress filters, which was enough to build a two-way DNS shell. Anthropic fixed the original report and paid a bounty.
João Maria Campos Donato, who publishes as João Donato, is an AI red team researcher at Zenity with an MSc in Informatics Security. His work focuses on model misuse, prompt injection and system-level failures.
With Raul Klugman-Onitza, he published a Claude in Chrome series showing how a prompt injection hidden in an email could escalate to full account takeover.
Anyone building on a managed agent platform will want to check their defaults after this one.
If one prompt can walk an agent from its own identity into S3, should agent platforms ship with deny-by-default permissions, or is that on the builders?
Source: r/pwnhub · by /u/_cybersecurity_