Skip to content
Threat Feed
Subscribe

Product

Amazon Bedrock AgentCore

2 briefs RSS
high advisory

Abuse of AWS Bedrock AgentCore Execution Role Credentials for Cloud Privilege Escalation

Anomalous AWS API calls by an Amazon Bedrock AgentCore execution role indicate potential credential exfiltration and abuse for cloud privilege escalation, lateral movement, or reconnaissance outside its intended runtime environment.

Amazon Bedrock AgentCore +1 cloud-security aws bedrock privilege-escalation credential-access microvm code-interpreter
1r 2t
high advisory

AWS Bedrock AgentCore Runtime Prompt Targeting Credentials or Instance Metadata

This rule detects prompts sent to Amazon Bedrock AgentCore runtimes that attempt to harvest credentials or exfiltrate data by referencing cloud instance metadata services, explicit AWS access/secret keys, or combining prompt-injection/jailbreak language with intent to reveal secrets or send data to external endpoints, indicating an attempt to weaponize the agent for credential theft.

Amazon Bedrock AgentCore cloud-security llm ai prompt-injection credential-access data-exfiltration
1r 1t 2i