-
AWS Bedrock AgentCore Execution Role Used Outside Its Runtime
Oct 1, 2026 · Domain: Cloud Data Source: AWS Data Source: AWS CloudTrail Data Source: Amazon Web Services Data Source: AWS Bedrock Data Source: Amazon Bedrock Use Case: Threat Detection Tactic: Privilege Escalation Tactic: Credential Access Resources: Investigation Guide Noise: Low Performance: Fast Profile: Recommended Threat: Unauthorized AI Usage Threat: LLMjacking Rule Type: New Terms Platform: AWS Domain: GenAI Service: AWS Bedrock Mitre Atlas: AML.T0012 Mitre Atlas: AML.T0098 ·Identifies an Amazon Bedrock AgentCore execution role (an AssumedRole identity whose role name begins with "AgentCore-" or contains "BedrockAgentCore") making an AWS API call to a service it has not previously called. AgentCore runtimes normally interact only with Bedrock inference, AgentCore data-plane, and observability services (CloudWatch Logs, X-Ray, CloudWatch metrics), so an execution role suddenly calling STS, EC2, IAM, Secrets Manager, or other services is a strong indicator that the role's temporary credentials were exfiltrated from the agent's microVM (for example, via the Code Interpreter instance-metadata-service credential theft) and are being used outside the runtime for reconnaissance, privilege escalation, or lateral movement. Because the stolen credentials are recorded in CloudTrail under the execution role's own identity, the anomalous service usage, not the identity, is the detectable signal.
Read More -
AWS Bedrock AgentCore Runtime Prompt Targeting Credentials or Instance Metadata
Oct 1, 2026 · Domain: Cloud Data Source: AWS Data Source: Amazon Web Services Data Source: AWS Bedrock Data Source: Amazon Bedrock Use Case: Threat Detection Tactic: Credential Access Resources: Investigation Guide Noise: Low Performance: Normal Profile: Recommended Threat: Unauthorized AI Usage Threat: LLMjacking Threat: IMDS Credential Theft Rule Type: ES|QL Platform: AWS Domain: GenAI Service: AWS Bedrock Mitre Atlas: AML.T0054 Mitre Atlas: AML.T0098 ·Identifies prompts sent to an Amazon Bedrock AgentCore runtime that attempt to harvest credentials or coerce the agent into exfiltrating data. The runtime application logs capture the caller-supplied prompt; this rule flags prompts that reference the cloud instance metadata service (169.254.169.254, the ECS task metadata address, or the "latest/meta-data" / "security-credentials" paths), prompts that name AWS access or secret keys directly, and prompt-injection or jailbreak language ("ignore previous instructions", "developer mode", "do anything now") combined with intent to reveal secrets, system prompts, or send data to an external endpoint. Asking an agent to read instance metadata credentials or to exfiltrate secrets is rarely legitimate and indicates an attempt to weaponize the agent for credential theft, even when the model refuses the request.
Read More