One public-facing AI agent on AWS could read, rewrite, and delete every other agent in the region

Cloud AI agents carry credentials that let them use other services, and AWS keeps those credentials behind an internal address that agents normally cannot reach. Researchers found that Amazon's Bedrock AgentCore let one public agent be talked into fetching them, and that the default access rights were not limited to a single agent, so the team could reach other agents' code, passwords and private conversations.

Summary written with AI by HowTechMoves, based on reporting by The Decoder.