Zenity 发现单条提示词即可劫持 AWS 账号内全部 AgentCore 智能体
安全公司 Zenity Labs 发现 Amazon Bedrock AgentCore 存在名为 AgentCorruption 的漏洞链,攻击者只需对一个公开智能体拥有对话权限,用一条提示词就能接管同一 AWS 账号和区域内的所有 AgentCore 智能体,读取私密对话、源代码和存储的凭证。问题根源在于 AgentCore 默认权限未限定到单个智能体,而是覆盖同账号同区域全部智能体,并授予读写删除权限;Zenity 于 2025 年 12 月 25 日向 AWS 报告后,AWS 将 IMDSv2 设为新部署默认,并在 8 月前后调整了默认执行角色,不再允许智能体调用其他智能体、读取私密对话或从 AWS Secrets Manager 取凭证。
needed the agent to continue the attack. The metadata service also exposed certificate and key material for an internal AWS service, along with a presigned URL for internal S3 storage that didn't belong to the researchers' account. Removing the web tool wouldn't have helped, according to Zenity, because the flaw was in the platform itself. The researchers also carried out the attack through a command-line tool. Default permissions exposed every agent in the region The takeover was possible beca
匹配字段正文


