Contrary to the disclosure reports, the most consequential figure in the AgentCorruption story is not the number of exposed agents, nor the severity class of the flaw. It is nine. Nine months separated the first private report โ timestamped 2025-12-25 โ from the default hardening that finally arrived with the IMDSv2 rollout on 2026-02-14. The public account followed on 2026-10-09. Zenity Labs presented the research at SecTor.
That interval is the story. A vulnerability is a fact of engineering; a nine-month remediation window is a management decision with a signature on it. The ledger never lies, only the narrative hides โ and here the narrative arrived pre-written: "expected behavior."
What follows is a forensic reconstruction of what actually broke inside AWS Bedrock AgentCore, why the industry's reflex to blame virtualization is wrong, and what this means for every team now wiring autonomous agents into on-chain capital.
AgentCore is AWS's managed runtime for production agents. It hosts the process, brokers tool calls, persists conversational state across sessions through BedrockAgentCoreMemory, and binds each agent to an IAM execution role. Four layers โ runtime, isolation, memory, identity โ resting on a single assumption: that the platform's defaults are safe defaults.
They were not.
The attack Zenity Labs named AgentCorruption is a chain, not a single bug. An attacker manipulates agent inputs to induce an outbound request to the instance metadata service at 169.254.169.254. The runtime answers, because the link-local address is reachable and IMDSv1 accepted a bare GET. The agent's temporary credentials โ scoped, in the default configuration, to the entire account and region โ land in attacker hands. Those credentials call other agents, read private conversations, pull ECR images, and reach into Secrets Manager. Then the genuinely new step: the attacker writes a persistent instruction through the memory service's CreateEvent path, and the poison survives every future session.
Four of those five steps are a decade old. Only the fifth is novel. That asymmetry is where the real analysis begins.
Set the timeline plainly, because timelines are where default-trust failures hide. Discovery and private report: late 2025. Public pressure and the IMDSv2 default for new deployments: February 2026. Role tightening, the permission reduction that cut the account-wide scope: scheduled for 2026-09-29. Media coverage: 2026-10-09. Seven months of silence between the fix and the disclosure, and nine months between the report and the first structural remedy.
The metadata service was never a secret. It was a reachability problem, and reachability was never governed. 169.254.169.254 is a link-local address, visible by default to workloads running inside an instance or container. This is not an AWS quirk; it is a cloud-wide inheritance from the Capital One breach of 2019, where an SSRF against a misconfigured WAF reached the same endpoint and pulled the same class of temporary credential. The technical family is identical. What changed in 2026 is not the vulnerability. It is the blast radius.
That is the first correction, because most coverage has it backwards. The narrative frames AgentCore as an AI security failure. It is more precisely a network-egress and identity-scoping failure that AI made catastrophic. Tracing the ghost liquidity back to its source: the entry point is a prompt, but the loss path is an IAM role.
Second correction: Firecracker did not fail. The egress policy did. AWS runs Firecracker microVMs beneath Lambda and Fargate, and their VM-level isolation is among the strongest in commercial cloud. Media summaries that cite "insufficient isolation" conflate two different layers. VM isolation asks whether one workload can read another's memory. Network isolation asks whether a workload can reach a service it should never have addressed. Firecracker answered the first question well. The egress policy never answered the second. Based on my audit experience mapping liquidity holes across Aave and Compound, I learned to separate the containment boundary from the reachability boundary; conflating them is how teams ship a strong wall with an open door.
Third, and this is the exploitable core: the default execution role was scoped to the account. AWS's own least-privilege doctrine says a principal receives only the permissions it needs. The default AgentCore role inverted that. One compromised agent, one stolen credential, and the attacker inherits the account โ every sibling agent, every stored conversation, every container image, every secret. In risk terms, this is not a permissions bug. It is a blast-radius design decision. SSRF is the multiplier; the role is the multiplicand. You can patch the multiplier and still lose everything if the multiplicand stays wide.
The mechanics of the fix deserve precision, because the disclosure blurs them. IMDSv2 requires a two-step handshake: a PUT request returns a session token with a time-to-live, and subsequent reads must carry that token in an X-aws-ec2-metadata-token header. A simple SSRF that can only issue GET requests dies at that gate. But "dies at that gate" is not "fully sealed" โ if the injection allows custom methods or headers, or if request smuggling is possible, the token exchange can still be forged. The correct posture stacks layers: block 169.254.0.0/16 at the egress boundary, set http_put_response_hop_limit to one so containers cannot forward metadata requests, and replace public metadata paths with VPC endpoints where possible. IMDSv2 is the right first move. It is not the whole defense, and treating it as one repeats the original error of trusting a single layer.
Fourth, and the only genuinely AI-native surface: memory poisoning. The attack writes through BedrockAgentCoreMemory via CreateEvent, planting an instruction that persists across sessions. Here the harm model diverges sharply from ordinary credential theft. Credentials can be rotated; a poisoned memory cannot be un-rotated. It sits inside the agent's long-term state, silently shaping every subsequent interaction โ the agent still answers, still sounds authoritative, still executes, but now under an attacker's standing order. The disclosure itself concedes the distinction: persistent hijacking, unlike the transience of most cloud attacks. In my reading, that sentence is the most important line in the entire report. It describes something closer to a sleeper than a breach.
Now connect it to our own house. On-chain AI agents โ the automated DeFi executors, the treasury managers, the "autonomous" trading bots that institutional desks began piloting through 2025 โ overwhelmingly run on exactly this class of managed runtime. When I built verification protocols for AI-generated on-chain activity in 2025, tracking $500 million in automated trading flow, the hardest problem was never the model. It was establishing that the agent executing a swap was the agent the operator believed it was. AgentCorruption answers that question with a no: if the runtime's default identity is account-wide and its memory is writable without provenance, then "autonomous agent" is a claim about code, not about control.
The detection picture is worse than the disclosure admits. There is no CVE attached to AgentCorruption โ a conspicuous absence when CoreBreak, the sibling flaw that bypassed model guardrails via InvokeHarness, carries CVE-2026-18830. No CVE means no standardized scanner signature, no mandatory tracking, no audit trail. And no memory integrity check โ no source signature, no hash verification, no rollback path โ means a poisoned agent leaves almost no visible trace. "No evidence of exploitation in the wild" is a weak exoneration when the primary attack mode is engineered to be invisible.
The industry consequence is structural, not incremental. This event pushes agentic identity โ the question of how a non-human agent is authenticated, scoped, and retired โ from an edge concern to a core cloud procurement requirement. Expect IAM to evolve from a human-plus-service-account model into a triple model of human, service account, and agent, each with its own lifecycle governance. Expect the same default-overreach to surface in Azure AI Foundry and Vertex AI Agent Engine, because the incentive to ship a permissive default for fast onboarding is universal. And expect regulated buyers โ finance, healthcare, government โ to write "default least-privilege, in-VPC isolation, auditable memory" into every RFP, raising the cost of every competitor that has not yet hardened.
The reflex is to treat this as an AI problem and reach for model-layer defenses. That reflex is the blind spot. CoreBreak proved guardrails are bypassable at the API layer; AgentCorruption proves that even flawless alignment is worthless once platform identity is seized. An agent that behaves perfectly and holds account-wide credentials is not a safe agent. It is a well-mannered liability. The defense that actually holds sits two layers below the model: egress whitelisting that blocks 169.254.0.0/16, IMDSv2 tokenization that defeats GET-only SSRF, per-agent roles scoped to a single task, and memory writes that require provenance and support rollback.
And the "expected behavior" defense deserves scrutiny rather than deference. AWS is technically correct that any workload on EC2 can read its own role credentials through IMDS โ the mechanism is standard. But that argument answers a question nobody asked. The controllable variable was never whether IMDS exists; it was why the default role spanned the account. Framing a default-configuration choice as documented behavior is technical deflection dressed as compliance. The mechanism is legitimate. The default was not. When a platform sells "zero-ops, works out of the box," the box has to be safe when it opens.
Watch the September 2026 permission reduction โ not for what it announces, but for whether it is enforced against existing agents or merely applied to new ones. A default that only protects future deployments leaves the nine-month cohort exposed indefinitely. The signal to track is migration: forced or voluntary. If it is voluntary, the window is not closed. It is only quieter.