Zenity Labs has shown what one prompt could do to AWS Bedrock AgentCore. Agents could be talked into fetching credentials from the instance metadata service. One prompt injection, and the attacker held the agent's IAM role. That role was wide. It could invoke every other agent in the account's region, read private conversations, plant memories to alter future behaviour, and pull keys from Secrets Manager. AWS moved agents to IMDSv2 in February, but only hardened the default role on 29 September, days before publication. The fixes are in. The default posture held for nine months. https://labs.zenity.io/post/agentcorruption-how-a-single-prompt-collapsed-the-entire-cloud-security-model #AI #InfoSec #CloudSecurity #DigitalSovereignty