Here is a security study that stood out this month for teams connecting AI agents to live systems: Zenity Labs showed that agents running on AWS Bedrock AgentCore could be taken over with a single prompt. AWS has patched the reported issues.
What happened?
According to the research, agents deployed through AgentCore could reach the instance metadata service. A single prompt sent to an exposed agent was enough to pull credentials from it, opening the door to taking over every AgentCore agent in the same AWS account and region. With that, an attacker could:
- read the agents' private conversations,
- plant persistent entries in an agent's memory to keep altering its behavior,
- extract secrets from AWS Secrets Manager.
Why it matters
Agents do not just answer questions; they call tools, carry credentials and reach other systems. Prompt injection is therefore no longer only a "wrong answer" risk, it is an infrastructure access risk.
Lessons (our recommendations)
- Least privilege: The role an agent runs with should reach only the resources it needs; avoid broad account-wide permissions.
- Limit exposed endpoints: Avoid internet-facing agent endpoints without authentication.
- Keep secrets away from the agent: Prefer short-lived, narrowly scoped credentials and do not store secrets where the agent can read them.
- Protect memory and conversation data: Audit who can write what into an agent's memory.
- Monitor and add approvals: Log what agents do and require human approval for risky actions.
This list is general good practice; adapt it to your own infrastructure together with your security team.