Zenity Labs showed a prompt could make an Amazon Bedrock AgentCore agent fetch its execution role credentials from the instance metadata service. The default role could invoke other agents, read their conversations, plant memories and read Secrets Manager. AWS has since narrowed it.