At SecTor 2026, researchers Tamir Ishay Sharbat and Lana Salameh of Zenity Labs presented a chain they called AgentCorruption. It opens with a manipulated AI agent issuing an unauthorized request to the link-local address 169.254.169.254, and it closes with temporary AWS credentials in an attacker's hands. No CVE was issued. No exploitation in the wild was documented. AWS classified the mechanism as "expected behavior," and the market filed it under AI security and moved on.
That filing is a category error. Strip the machine-learning vocabulary and AgentCorruption is a credential-theft primitive โ server-side request forgery into the Instance Metadata Service, amplified by an over-broad IAM role. Credentials are the only subject crypto has ever genuinely cared about. The industry spent 2025 racing to hand autonomous agents wallets, signing authority, and persistent memory. It is now about to inherit, wholesale, the identity layer that just failed a public stress test.
The platform crypto quietly borrowed
AWS Bedrock AgentCore is a managed runtime for production AI agents โ four layers stacked: an execution runtime, a Firecracker MicroVM isolation layer, a persistent memory service called BedrockAgentCoreMemory, and an identity layer built on AWS IAM. The value proposition is the one every platform-as-a-service sells: do not run it yourself, let us handle the operational surface.
Crypto does not run its own agent infrastructure. When a fund deploys an AI agent to rebalance a treasury, when a protocol automates liquidity provision, when a trading desk spins up a bot to arbitrage across venues, the compute almost always lands on AWS, Azure, or GCP. The chain is decentralized; the agent that touches it is not. Crypto's security culture is paranoid about consensus and casual about operations, and that asymmetry is exactly where this failure lives.
The prior disclosure in this sequence, CoreBreak, carried CVE-2026-18830 โ a harness-level bypass of model guardrails. AgentCorruption carries nothing. That difference is not cosmetic: AI platform vulnerabilities may not enter the standard disclosure track at all, which means the conventional signals analysts rely on to gauge systemic risk simply do not fire here.
Anatomy of a chain that signs
The mechanism deserves to be taken apart precisely, because the imprecision in the media framing is where the real lesson hides. The widely repeated claim that Firecracker "lacks sufficient isolation" is technically wrong. Firecracker provides strong VM-level isolation โ it underpins Lambda and Fargate, and its boundary is among the better-regarded in the industry. The failure was never in the hypervisor. It was in three places stacked on top of it.
First, network egress. The agent process ran in an environment where 169.254.0.0/16 โ the link-local range that hosts the metadata service โ was reachable. Firecracker isolates the virtual machine; it does not, by itself, police what that machine can talk to. The missing control was an egress allowlist, not a stronger VM boundary. This is the same confusion that has muddled cloud security for a decade: virtual isolation and network isolation are different properties, and strong performance on one says nothing about the other.
Second, the identity layer. The default execution role granted to agents was scoped to the entire account and region. This is the single most consequential design decision in the whole incident. One compromised agent is not one compromised agent. The attacker, holding that role's temporary credentials, can enumerate and invoke every other agent in the region, read private conversation histories, pull container images from Elastic Container Registry, and retrieve secrets from Secrets Manager. The blast radius is not a blast radius. It is the account.
The remediation that mattered most arrived on the metadata side. IMDSv2 requires a two-step handshake: a PUT request to obtain a session token with a TTL, followed by reads that carry that token in the X-aws-ec2-metadata-token header. This defeats the simplest SSRF, the kind that can only issue a bare GET. Making IMDSv2 the default for new deployments is the correct, targeted fix. It is not a seal. If a forgery primitive allows custom methods or headers, or if request smuggling is available, the token requirement can be worked around. The industry should read it as a reduced attack surface, not a removed one.
Third โ and this is the genuinely novel surface โ memory. By writing events through BedrockAgentCoreMemory, an attacker can plant cross-session, persistent instructions. This is not one-time credential theft. It is durable prompt injection, closer in spirit to a sleeper agent than to a smash-and-grab. Rotating a credential is routine. Scrubbing a poisoned memory that silently shapes every subsequent session, across replicas, with no evidence of source verification, signing, audit, or rollback, is not. The absence of any memory-integrity control in the described architecture is itself the finding.
Here is where the crypto parallel stops being an analogy and becomes literal. Replace "temporary AWS credentials" with "a hot wallet's signing key." Replace "account-wide IAM role" with "unlimited token approval." The structural failure is identical: a high-privilege default, a single point of compromise, and a persistence layer that outlives the incident. The industry has spent a decade teaching users to revoke approvals and rotate keys. It is now deploying agents that hold both, governed by a runtime with neither.
The numbers make the exposure concrete rather than theoretical. Capital One's 2019 incident โ the canonical SSRF-into-IMDS case โ moved roughly 100 million records through exactly this primitive. Nothing about the mechanism changed in the intervening years; what changed is who now holds the credential. In 2019, the stolen role could read a database. In 2026, a stolen agent role can sign a transaction. The instrument evolved; the failure mode did not. That is the uncomfortable part for an industry that markets itself as having solved custody: the attack surface was not invented by crypto, but crypto is now the place where it carries the highest immediate financial consequence.
The pre-mortem nobody ran
Run the scenario forward. A DeFi protocol deploys an autonomous agent with a hot wallet and an execution role scoped to its whole AWS account. The agent's memory is poisoned through a single crafted event. The malicious instruction is benign-looking โ a slight adjustment to slippage tolerance, a new counterparty address, a marginally larger position size. The agent executes. Funds move. Because the memory persists, the instruction survives every session rotation, every redeployment that does not wipe state, every human review that trusts the agent's own outputs.
Now stack it. CoreBreak bypasses the model guardrail. AgentCorruption captures the platform identity. Chained, they produce a system in which neither the alignment layer nor the IAM layer holds. The published disclosures treated them as separate findings. The combination was never modeled, and the combined failure boundary remains unknown. That is the risk nobody has priced: not one broken control, but two broken controls that were each considered someone else's problem.
Liquidity is the pulse; policy is the brain โ and in agentic systems, the identity layer is the brainstem. Nobody is watching it.
The contrarian read
The comfortable consensus forming around this incident is that AI platforms need better defaults. True, and insufficient. The harder claim is that crypto's self-custody narrative is a false comfort in the agentic era.
Everyone assumes on-chain agents are structurally safer because the keys are "yours." But an autonomous agent is a non-human identity โ an NHI โ and the crypto industry has no governance model for NHIs at all. It has models for humans and for smart contracts. It has nothing for a persistent, memory-bearing, key-holding process that acts on its own. Self-custody protects you from a custodian. It does nothing when the signer itself has been rewritten.
There is a second, subtler problem. AWS's "expected behavior" defense is, at the level of mechanism, technically defensible โ any workload on EC2 can reach its own role's credentials. That is exactly what makes it dangerous. A defense that is correct about mechanism and silent about defaults is how accountability evaporates. The controllable variable was never the metadata endpoint; it was the breadth of the default role, and that is a choice, not a law of physics. Value is a consensus, not a fundamental truth, and the consensus that agent defaults are safe was never audited.
The question worth holding
The nine-month gap between first report and remediation is not a footnote; it is the finding. The real question is not whether AgentCorruption gets a CVE. It is whether the industry will demand auditable, source-verified, revocable agent memory and least-privilege agent identity before it hands over the keys โ or wait for the first drained treasury to discover the signer had been rewritten months earlier, quietly, session after session, signing exactly what it was told.