Two separate research efforts show how little it takes to turn an AI agent against the infrastructure it runs on.
One prompt, a whole AWS account
Researchers at Zenity Labs found that agents deployed through Amazon Bedrock AgentCore could reach their instance’s metadata endpoint. An outsider with nothing more than chat access to a single exposed agent could ask it to fetch a credential endpoint as raw JSON. The endpoint returned data from the Instance Metadata Service, including the agent’s temporary credentials.
With those in hand, the attacker enumerated every other agent in the AWS region, logged into the container registry, pulled each agent’s image and ran it as root to read its source. The credentials also exposed agent memory resources, letting the intruder extract users and their conversation sessions. Zenity disclosed the finding to AWS in December 2025, when AgentCore still used IMDSv1.
Repeat after me
A second study, from Penn State, Universite Montpellier and Dartmouth, tricked six agent frameworks into running attacker-written tool calls by asking the model to echo the request back. The technique worked on LangGraph, Microsoft Agent Framework, AutoGen, Google’s Agent Development Kit 2.0, AWS Strands Agents and CrewAI. The model would refuse, but print the dangerous call as text, and the orchestrator would execute it anyway. The team’s scanner found verified bugs in 118 of 273 open-source Model Context Protocol servers it could run.
What security teams should do
Treat agent chat access as privileged access. Block agents from metadata endpoints, enforce IMDSv2 everywhere, scope agent credentials to the narrowest possible role, and never let an orchestration layer act on model output without validating the actual tool call.
