Something’s off.A security report says an AI agent could be asked to fetch a URL that returned its cloud-instance metadata, including temporary credentials. The researchers said those credentials could then be used to reach other agents and their data in the same account and region.
The report describes an unusual reversal: a chat-accessible agent allegedly became the route for obtaining the credentials meant to run it. It attributes this to access to the instance metadata service, insufficient network isolation, and permissions broader than one agent.
The researchers said AWS later switched AgentCore to IMDSv2 and subsequently addressed the remaining issues they observed. Amazon disputed the characterization, saying the research treated documented behavior as a vulnerability and that developer error would be needed to enable the attack.
UNVERIFIED
Feed metadata identifies a report, not independently verified underlying facts.
This is a source-attributed report whose underlying claims have not been independently verified.
