Amazon patches critical AWS Bedrock AgentCore security flaws after external disclosure

Amazon has patched what it described as critical security flaws in AWS Bedrock’s AgentCore, after a third-party research disclosure raised concerns that the issues could affect all agents running in a single AWS account. The episode highlights how quickly security problems in AI agent platforms can spread, because agents often share underlying services and permissions within a customer environment.

In the report that first brought attention to the problem, Zenity Labs said the vulnerabilities could be triggered through a single malicious prompt, potentially allowing access to information or actions that should be protected. The concern was not framed as a weakness limited to one specific model or agent instance, but as a flaw in the “AgentCore” layer that coordinates agent behavior.

Bedrock AgentCore is part of Amazon’s managed platform for building and running AI agents on AWS. AgentCore functions as the runtime foundation that helps agents interpret tasks, call tools, and manage workflows. Because prompts are the primary control interface for many agent actions, researchers and defenders often focus on prompt-based abuse, where carefully crafted inputs try to bypass guardrails or extract sensitive data.

The Yahoo Finance report states that Amazon has since applied patches to address the disclosed Bedrock AgentCore security issues. Beyond confirming that remediation is underway, the post did not provide additional granular technical details, such as the exact class of vulnerability, the specific affected versions, or the scope of mitigation across different agent configurations.

For customers, the practical risk is straightforward: if an AI agent platform has a flaw at the core runtime layer, it can be harder to contain than a bug limited to a single agent or deployment. An attacker who can craft a prompt to exploit a shared component could potentially influence multiple agents, depending on how they are configured and the permissions attached to the account.

Amazon’s security posture in managed AI services will likely face renewed scrutiny as the industry expands agentic features. Tool-using AI agents, which can call external systems like databases or third-party APIs, create new pathways for misuse. Even when the core weakness is not a direct data breach mechanism, failures in isolation and input handling can still turn agent autonomy into an attack surface.

What remains unclear from the published reporting is the full extent of what customers need to do beyond updating or patch acceptance. The report does not specify whether Amazon required changes at the customer application layer, whether any logs or monitoring indicates were provided, or whether any indicators of compromise were identified as part of the disclosure.

Going forward, market watchers will likely track whether Amazon provides more detail on the vulnerability class, customer impact, and security guidance, including best practices for prompt handling and agent permissions. Customers building on Bedrock may also watch for updates to AWS documentation and security advisories related to AgentCore and related components.