Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Cracks in the Bedrock: Agent God Mode

Summary: Unit 42 found that the Amazon Bedrock AgentCore starter toolkit's auto-create logic generates IAM roles with wildcard permissions across the AWS account rather than scoped to individual resources, a configuration it calls Agent God Mode. The default policy lets any agent read or poison other agents' memory records, invoke any Code Interpreter, pull any ECR image to extract source code and baked-in resource IDs, and trigger execution of any other agent via InvokeAgentRuntime. After disclosure, AWS updated its documentation to warn that the default roles are designed for development and testing and should never be used in production.

Key Takeaway: A single compromised agent inherits enough default permission to read every other agent's memory, pull any container image in the account, and invoke higher-privileged agents - so one weak agent becomes the entry point to all of them. AWS's own security team states these auto-created roles should never be used in a production system.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related