Amazon Bedrock AgentCore SDK Flaw Could Allow Credential Theft

Security researchers have identified a vulnerability in Amazon Bedrock's AgentCore software development kit that may let hostile actors execute arbitrary commands inside the platform's AI sandbox and harvest AWS credentials attached to the service.

AgentCore is a core component of Bedrock, Amazon's managed suite for building generative‑AI agents that can interact with external data sources and perform automated tasks. The flaw stems from insufficient validation of inputs passed to the SDK, which can break the isolation mechanisms that keep the AI runtime separate from the underlying cloud environment.

By crafting specially designed prompts, an attacker could trigger code execution that escapes the sandbox, gaining read access to the instance profile or IAM role credentials provisioned for the Bedrock workload. Those credentials, if exfiltrated, could be used to invoke other AWS services, read data stores, or launch further attacks across the victim's cloud account.

The issue was first reported by Infosecurity Magazine, which cited internal testing that demonstrated the exploit in a controlled environment. Customers who have deployed Bedrock agents that rely on the AgentCore SDK are potentially exposed, especially those that run with broad IAM permissions or that have not applied recent security hardening recommendations.

Amazon has acknowledged the report and said its security team is reviewing the findings. The company is expected to issue a patch or update to the SDK and has urged users to rotate any credentials that may have been compromised, enforce the principle of least privilege, and enable continuous monitoring for anomalous API activity. The discovery highlights the growing need for rigorous security vetting of AI‑centric development tools as they become integral to cloud workloads.