Cracks in the Bedrock Agent God Mode

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://unit42.paloaltonetworks.com/exploit-of-aws-agentcore-iam-god-mode/
• Blog Title: Cracks in the Bedrock: Agent God Mode
• Suggested Section: AWS Pentesting -> Post Exploitation (AWS - Bedrock Post Exploitation) or a new page under AWS Post Exploitation: "Bedrock AgentCore insecure defaults / Agent God Mode (wildcard IAM → cross-agent compromise, ECR image exfiltration, Code Interpreter role pivot)"

🎯 Content Summary

Title
Cracks in the Bedrock: Agent God Mode (Unit 42, published April 8, 2026)

What this post is about (root issue)
Unit 42 analyzed Amazon Bedrock AgentCore’s AgentCore starter toolkit (a CLI used to deploy agents to AgentCore Runtime). The toolkit’s auto-create provisioning path prioritizes “quick start” over lea...

🔧 Technical Details

Exploit primitive: insecure IAM defaults that use wildcard resource ARNs
When an auto-provisioning/deployment toolkit generates execution roles whose permissions target wildcard ARNs (e.g., arn:aws:bedrock-agentcore:*:memory/*, arn:aws:bedrock-agentcore:*:runtime/*, arn:aws:ecr:*:repository/*), compromising one workload identity can break isolation across peer workloads. The attacker doesn’t need to escalate to a separate AWS principal; they simply reuse the compromised role’s broad permissions to access resources that belong to other workloads/agents in the same account.

Technique: ECR image exfiltration for offline secrets/identifier discovery
If an identity can obtain an ECR auth token and pull arbitrary images from ECR, the attacker can download container images and perform static/offline filesystem analysis to recover sensitive files and configuration baked into the image. This often reveals internal identifiers...

🤖 Agent Actions

I’m mapping the repo first and then reading the most relevant AWS/AI pages before deciding where this Bedrock AgentCore content belongs. After that I’ll verify the IAM and AgentCore details against current AWS documentation and patch the best-fitting file.
The repo already has a dedicated Bedrock post-exploitation page, plus separate Bedrock privesc and ECR pages. I’m reading those and adjacent AWS pages now to avoid duplicating existing coverage and to keep the new content confined to a single, well-placed file.
I’ve confirmed the existing Bedrock post-exploitation page already covers other Bedrock-specific attack classes, while the interpreter-role pivot is already documented separately under Bedrock privesc. Next I’m verifying the current AWS AgentCore docs and the exact permission model so the new section adds only the missing cross-agent “god mode” chain.
I’ve now checked the current Bedrock/ECR pages plus the upstream toolkit/docs. The missing piece is not generic ECR pulling or the standalone Code Interpreter pivot, but the specific AgentCore runtime-role misconfiguration chain: wildcard runtime/memory/ECR scope on one agent leading to cross-agent compromise.
I have enough context to edit now. I’m adding one new Bedrock post-exploitation section that focuses on the actual missing technique: wildcard AgentCore runtime roles enabling cross-agent ECR exfiltration, memory abuse, and runtime invocation, with short operator-focused steps and links back to the existing ECR and Bedrock privesc pages for the detailed primitives.
The edit is in place. I’m doing a final pass on the rendered markdown and diff now to ensure the internal refs are correct, the new section stays non-duplicative, and the references block remains at the end of the file.
Updated README.md with a new Bedrock post-exploitation section for AgentCore runtime-role wildcard abuse.

The added content focuses on the missing technique from the blog rather than duplicating existing pages: cross-agent compromise caused by overly broad AgentCore runtime IAM roles, chained through ECR image exfiltration, MemoryID extraction, cross-agent memory access/poisoning, and peer runtime invocation. I kept the detailed ECR pull flow and Code Interpreter pivot as internal refs to the existing ECR post-exploitation and Bedrock privesc pages, and updated the file’s final ## References section with the Unit 42 post plus current AWS docs/toolkit sources.

No new file was created. Only this file was modified.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://unit42.paloaltonetworks.com/exploit-of-aws-agentcore-iam-god-mode/

Content Categories: Based on the analysis, this content was categorized under "AWS Pentesting -> Post Exploitation (AWS - Bedrock Post Exploitation) or a new page under AWS Post Exploitation: "Bedrock AgentCore insecure defaults / Agent God Mode (wildcard IAM → cross-agent compromise, ECR image exfiltration, Code Interpreter role pivot)"".

Repository Maintenance:

• MD Files Formatting: 584 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0