Zenity称单提示可劫持AWS AI代理
AgentCore隔离与默认权限问题让研究者跨代理获取凭据与数据。
为什么重要
提示注入可升级为云凭据泄露，开发者需强化代理隔离与最小权限。
阅读原文the-decoder.com
AI 解读（根据原文生成）
Zenity Labs研究人员称，他们在Amazon Bedrock AgentCore中发现一条名为“AgentCorruption”的漏洞链。攻击者只需能聊天访问一个公开代理，就可通过单个提示让代理查询内部元数据服务并外传临时AWS凭据，进而接管同一AWS账号和区域内的AgentCore代理，读取私聊、下载源码并获取存储凭据。AWS已部分修复，包括让新代理更难检索内部元数据、收紧默认执行角色；研究者建议企业手动为代理配置最小权限角色。
要点（AI 据原文整理，数字均已与原文核对）
- A chain of vulnerabilities in Amazon's Bedrock AgentCore platform let researchers take over all of a company's AI agents in the same AWS region through a single chat message to one public agent.
- Agents lacked proper isolation and handed over internal AWS credentials when asked.
- The platform granted broad default permissions across the entire region.
- AWS has partially fixed the issue by making it harder for new agents to retrieve internal metadata and by tightening the default execution role.
- AWS runs an Instance Metadata Service at the internal address 169.254.169.254.
- The stolen credentials worked outside the platform on the researchers' own machine.
