Skip to content
ERP LEADERS
Subscribe to the brief Follow on LinkedIn

The news behind the software that runs companies, explained for everyone.

ERP programmes

One prompt could take over AWS AI agents, researchers said. AWS called it "informative".

Researchers at Zenity say a single prompt to an exposed agent on Bedrock AgentCore, the AI agent service of Amazon Web Services (AWS), could pull temporary credentials from the machine it ran on, The Register reported on 9…

ERP LEADERS news desk · · First reported by The Register (Thomas Claburn) · Edition no. 33

Researchers at Zenity say a single prompt to an exposed agent on Bedrock AgentCore, the AI agent service of Amazon Web Services (AWS), could pull temporary credentials from the machine it ran on, The Register reported on 9 October. With those, they say, an attacker could take over every AgentCore agent in the same account and region and read users' conversations.

They reported it to AWS in December 2025. In April 2026, AWS acknowledged the report as "informative" and closed the ticket, citing a change to the metadata service (IMDSv2) it had made in February. The broad default permissions persisted through 22 June. AWS addressed all the issues by 29 September, before Zenity went public.

After publication, Amazon said the research misrepresents documented behaviour as a vulnerability, and that developer error would be needed for the attack to work.

The dates are the arithmetic: about nine months from the first report in December to the last fix on 29 September. Through at least 22 June the default role covered every AgentCore agent in the same account and region.

Has anyone checked that each agent you run can reach only what it needs?

ERP LEADERS card: One prompt could take over AWS AI agents, researchers said. AWS called it "informative".
The card as published on LinkedIn. Photo: Tedder/Wikimedia, CC BY-SA 4.0 · original

Sources

Spotted an error? Tell us. Every correction is logged on Standards.

Your reading room

Companies in this story
Amazon Web Services (AWS)Zenity

Our file on AWS

  1. 20 Sept

    Infor shipped three AI agents into a distributor's ERP in two weeks.

  2. 10 Sept

    AWS made AI agents sign into SAP as you. No shared account.

All 4 AWS stories

For your next steering committee

Questions for your own programme. They are not findings about any company in this story.

  1. 1Ask which AI tools already touch your ERP or finance data, including the ones nobody approved.
  2. 2Ask what each tool is allowed to change, and who reviews what it changed.
  3. 3Ask how the result is measured, and who decides to switch a tool off.

Issue 01 of the ERP LEADERS brief puts a timeline, the three-number review and six questions on one page. Read issue 01

Founding reader view is on in this browser. It is a reading view, not secure access. Print the working sheet

Founding reader

Welcome back. · Issue 01

2 comments under this story on LinkedIn. Read the discussion

Keep reading

The ERP LEADERS brief Subscribe