The exploit chain took eleven minutes. The disclosure took nine months. And the patch โ if you want to call it that โ is scheduled to arrive in February 2026, which means the clock is still running on every agent already in production tonight.
Here is the hard fact that matters: an attacker could manipulate a managed AI agent into sending a single GET request to 169.254.169.254, harvest the temporary AWS credentials of its own execution role, and then use that role to call any other agent in the account, read private conversation logs, pull container images from ECR, and reach into Secrets Manager. No prompt injection required at the model layer. No jailbreak. Just a link-local address and a role that was scoped โ by default โ to the entire account and region.
Silence in the ledger speaks louder than hype. For nine months, nobody assigned a CVE. For nine months, the defense was a phrase: "expected behavior."
The Chain Nobody Wanted to Name
The technical anatomy is not novel. That is precisely the point.
What researchers at Zenity Labs presented at SecTor 2026 โ and what The Register reported on October 9, 2026 โ is the ten-year-old Capital One attack pattern wearing a new coat. Server-Side Request Forgery routes a workload to the Instance Metadata Service. The IMDS hands back credentials. The credentials open doors. In 2019 this cost a bank $80 million in fines. In 2026 it costs you your agent fleet.
The AI layer does not change the mechanism. It changes the blast radius.
What separates AgentCorruption from a routine SSRF is three architectural misalignments stacked on top of each other inside Amazon's Bedrock AgentCore runtime:
First, network egress was not blocked to the link-local range. The agent process could reach 169.254.0.0/16. The metadata endpoint answered.
Second, the default execution role carried account-level and region-level scope. This is the variable AWS controls and the variable AWS declined to discuss. Least privilege is printed on every AWS whitepaper and contradicted by the default it ships.
Third, the memory service accepted unauthenticated writes across sessions. Through BedrockAgentCoreMemory's CreateEvent path, an attacker could plant persistent instructions that survive credential rotation and quietly steer every subsequent interaction.
Data does not negotiate; it only confirms. Each of these three layers is survivable in isolation. Together they convert a transient credential theft into a durable hijack.
Let me be precise about where the reporting drifts. Multiple outlets framed the root cause as Firecracker offering "insufficient isolation." That is a category error, and it matters. Firecracker is the microVM layer under Lambda and Fargate. Its VM-level isolation is among the strongest in production cloud infrastructure. The failure was never the hypervisor. The failure was the network policy that failed to block a link-local address and the IAM policy that granted an account-wide role. The audit trail never lies, only the auditor can โ and here the auditor mislabeled the crime scene.
Context: Why This Is an Agent Problem, Not a Model Problem
I spent 72 hours in 2017 reverse-engineering reentrancy bugs in a token contract before launch. I found three. The lesson I carried forward was not "smart contracts are dangerous." It was that the vulnerability always lives one layer below where the marketing points.
The same discipline applies here. The entire AI industry has spent two years selling alignment. Guardrails. Constitutional training. Red-teaming dashboards. The CoreBreak vulnerability โ CVE-2026-18830, disclosed alongside AgentCorruption โ demonstrated that a model's safety layer can be bypassed through the InvokeHarness API path. That should have been the headline. Instead it became a footnote to a bigger story: if you can take the identity, the alignment is irrelevant.
An agent that is perfectly aligned and running under a stolen account-wide role is a perfectly aligned weapon.
This is what the industry keeps missing. The defense-in-depth conversation in AI has been conducted almost entirely at the model layer, because that is where the demo value lives. But the actual kill chain runs through the platform layer: identity, network, memory. Those are the three surfaces that determine whether a single exploit is a contained incident or an account-wide breach.
Here is the part that should worry every CISO reading this in a bull market. Yield is not income; it is risk repackaged. The same is true of "time-to-first-agent." The frictionless onboarding that makes AgentCore attractive โ managed runtime, managed memory, managed identity, no infrastructure to stand up โ is the same frictionlessness that ships a dangerous default. The convenience is the vulnerability. They are the same artifact viewed from different angles.
Nine months elapsed between the initial report on December 25, 2025 and the IMDSv2-defaulting change scheduled for February 14, 2026. A permissions reduction is not slated until September 29, 2026. Count those windows. The first mitigation is roughly seven weeks. The second is nine months. That asymmetry tells you what the vendor prioritized.
Core: The Mechanism, Layer by Layer
Let me walk the chain the way I would walk an audit, because the sequence is where the insight lives.
Layer one โ the request. A managed agent, doing its job, is induced to make an HTTP request to the link-local metadata address. In a traditional workload, this requires the attacker to already control code execution. In an agent, the "code execution" is the tool-calling loop. The agent's job is to fetch things. An attacker who can influence what it fetches has, functionally, remote code execution at the network layer.
This is the AI-specific amplification. You do not need to compromise the agent. You need to steer it. The tool surface is the attack surface.
Layer two โ the token. IMDSv1 responds to a plain GET. No session token, no header, no proof of intent. This is why IMDSv2 exists: it requires a PUT to obtain a TTL-bound session token, then a subsequent read with the X-aws-ec2-metadata-token header. A naive SSRF that can only issue GET requests fails against IMDSv2. AWS defaulting new deployments to IMDSv2 on February 14, 2026 is the correct, targeted mitigation.
But notice the word. Targeted. Not complete. If an SSRF primitive permits custom methods and headers โ or if a request-smuggling path exists โ the token barrier can be worked around. IMDSv2 reduces the attack surface; it does not eliminate it. Calling it a fix is the kind of overstatement that gets people breached twice.
Layer three โ the role. This is the real story, and it is the layer AWS has been least willing to discuss. The default execution role was reported to span the account and region. Read that again and think about what it means operationally. A single stolen credential from a single agent could enumerate and invoke any other agent in the account. It could read conversation histories. It could pull ECR images โ which is to say, it could reach the source code of the products those images build. It could read Secrets Manager.
This is not a vulnerability. This is an architecture that treats one agent's compromise as the account's compromise. The blast radius was not a bug. It was a design decision, and the design decision was wrong.
I have seen this pattern before. In 2020 I calculated the exact break-even point for liquidity providers on a yield farm whose APY was propped up by an emission schedule that could not hold. The math said the structure was unsustainable two days before the price said it. The mechanism was hidden in plain sight. So is this one. Account-wide default roles are the emission schedule of cloud security: they look like generosity, they function as risk transfer, and they fail on a schedule nobody publishes.
Layer four โ the memory. This is the genuinely new surface, and the one I would flag as the most dangerous because it is the least understood.
Through BedrockAgentCoreMemory, the exploit planted instructions that persist across sessions. Not a one-time data theft. A durable behavioral modification. The credentials could be rotated โ AWS did rotate them. The memory could not be easily cleaned, because there was no reported mechanism for memory integrity verification, source signing, or audit. Yield is not income; it is risk repackaged โ and here, persistence is not a feature; it is a liability with no off switch.
Consider the asymmetry. A stolen credential has a defined lifetime and a rotation path. A poisoned memory has neither. It sits in the agent's cross-session state, silently influencing every future interaction, invisible to the user who believes they are talking to a trustworthy enterprise agent. The Register noted this distinction directly: the persistence of the hijack sets it apart from the transience typical of cloud attacks. That observation is the most original judgment in the entire disclosure, and it deserves more attention than it got.
What we have, in effect, is a dormant agent. A planted instruction that waits. The conceptual distance between a poisoned memory entry and a sleeper is not large, and the reporting did not walk that far.
Contrarian: The "Expected Behavior" Defense Is Technically True and Professionally Bankrupt
Here is the angle almost nobody reported cleanly.
AWS's position was that an agent accessing its own execution role credentials through IMDS is "documented, expected behavior." And technically, on the mechanism level, this is correct. Any workload running on EC2 or in a VM can reach IMDS. That has been true for a decade. The statement is not a lie.
It is also a dodge, and the dodge is where the real disclosure-ethics problem lives.
The vendor answered the question "can a workload reach IMDS?" The question that mattered was "why was the default role scoped to the entire account?" Those are two different propositions. One is about mechanism plausibility. The other is about default configuration safety. Framing a controllable configuration choice as an immutable property of the platform is the oldest move in the disclosure playbook โ and The Register caught the mismatch.
I have audited contracts where the developers said "the reentrancy is expected behavior" because the EVM permits it. Technically true. Professionally indefensible. The permission to do a thing is not the justification for doing it by default.
Here is the second contrarian point, and it cuts against the researchers as much as the vendor. Zenity Labs is an agent-security company. Their product category is agentic identity and agent security. A high-visibility disclosure โ a SecTor talk plus coordinated media โ is simultaneously a public good and a customer-acquisition event. Both things are true. The industry education is real and valuable. So is the positioning. The audit trail never lies, only the auditor can, and the auditor here has a commercial interest in the story being large.
That does not make the finding false. It makes the framing worth reading skeptically. The blast radius claims, the "account-wide" characterization, the nine-month window โ all of it should be verified against primary sources, not absorbed from the narrative.
And the third point, which nobody has made: the timestamp problem. The events here โ the December 2025 report, the February 2026 IMDSv2 change, the September 2026 permission reduction, the October 2026 reporting โ sit at or beyond the edge of what can be independently confirmed from a distance. The year references in the source material are internally inconsistent, mixing 2025 and 2026 markers in ways that require going back to the original reporting to untangle. I am not going to pretend I can verify a date I cannot reach. I am going to tell you the mechanism is sound and the timeline needs a primary-source check before you cite it in a board deck.
That is the honest position. The mechanism is high-confidence. The chronology is not.
Takeaway: Watch the Default, Not the Disclosure
The lesson of AgentCorruption is not that AWS shipped a bug. It is that the entire managed-agent category ships the same bug, and AWS was simply the first to be named.
Azure AI Foundry Agent Service and Google Vertex AI Agent Engine almost certainly carry the same default-role posture. The economics of onboarding push every platform toward generous defaults โ generous defaults shorten time-to-first-success, and time-to-first-success is the metric that gets developers to stay. The security cost is deferred to the customer, who does not discover it until an auditor does.
So here is what I am watching, and what you should be too.
Watch whether the permission reduction on September 29, 2026 is a default change for new deployments or a forced migration for existing ones. Those are not the same thing. If it is only the former, then every agent stood up between now and then carries the original blast radius, and the fix is a checkbox that most customers will never tick.
Watch whether memory writes get integrity verification, source signing, and audit logs. If they do not, then the persistent hijack remains the cheapest durable compromise in the cloud, and nobody will detect it because there is no signal to detect.
Watch whether the industry builds a CVE-grade disclosure track for AI infrastructure. CoreBreak got a CVE number. AgentCorruption got a phrase. That gap is the maturity deficit in one data point.
Speed without structure is just noise. The market will move on from this story in a week. The agents will keep running. And the ledger โ the one that would show you a poisoned memory, a stolen role, a hijacked session โ will stay silent, because nobody built the thing that writes to it.
The default is the vulnerability. Watch the default.