2026-04-07 · 2026-Q2
AWS Bedrock AgentCore "Agent God Mode" Cross-Agent Memory Access
Should this run hold this key at all?
- Fixable
- Vendor patch
- Vendor response
- Unknown
- In the wild
- No
- Actor
- Attacker
Target
AWS Bedrock AgentCore starter toolkit
Impact
Default IAM roles auto-created by the toolkit scope permissions to wildcard, letting any agent read or poison memory belonging to every other agent in the AWS account; enables privilege escalation and cross-tenant data exfiltration
Root cause
Starter toolkit auto-create logic issues IAM policies with GetMemory and RetrieveMemoryRecords on resource "*" instead of per-resource scoping
Sources
Catalog
Cite this: AgentProv incident record: AWS Bedrock AgentCore "Agent God Mode" Cross-Agent Memory Access (2026-04-07). https://agentprov.com/incidents/2026-04-07-aws-bedrock-agentcore-agent-god-mode-cross-agent-memory-access
Related
- Also L1 · 2026-10-21LiteLLM 1.107.0 on PyPI and Docker Ships a Credential Stealer That Runs at Every Python StartupL1Credential
- Also L1 · 2026-10-17OpenCode Console Breach Exposes Users' Stored OpenAI, Anthropic, and Google API KeysL1Credential
- Also L1 · 2026-10-13IBM MCP Context Forge Shipped a Known JWT Secret, Letting Anyone Mint Platform Admin Tokens (CVE-2026-53709)L1Credential