AMAZON BEDROCK AGENTCORE / WHAT GOES WRONG, AND WHY
COMMON MISTAKES, EXPLAINED
CHAPTER 03 / 36
FOR humans, plain language
REV 2026.07
These are the traps people hit when they first build on AgentCore. Each one says the mistake, what happens, and how to avoid it. If a word is new, see chapter 02 "Key terms".
01Wrong chip type
AgentCore runs on ARM64 (Graviton) chips. If your container image was built for a normal Intel/AMD chip, the agent cannot start. You see an "exec format error" or a 504.
FIXBuild the image for ARM64. The AgentCore CLI does this for you.
02Long work looks idle
While an agent does a long task, it must tell the /ping health check it is "HealthyBusy". If it does not, AgentCore thinks the session is idle and stops it after 15 minutes.
FIXReport HealthyBusy during background work.
03Expecting old chats to be remembered
Long-term memory is only built from conversations that happen after you turn a memory strategy on. It does not go back and process older chats.
FIXEnable the strategy before the conversations you care about.
04Secrets in the wrong place
"Event metadata" is small labels you attach to memory events. It is not encrypted with your own key, so passwords or secrets stored there are exposed.
FIXNever put secrets in event metadata.
05Giving too much access
Broad AWS (IAM) or login (OAuth) permissions are dangerous if the agent is tricked: it could reach things it never should.
FIXGrant only the minimum access needed (least privilege).
06Confusing the two protocols
MCP connects an agent to tools. A2A connects an agent to other agents. Using one where you need the other will not work.
FIXTools = MCP. Other agents = A2A.
07Code sandbox left open to the internet
The Code Interpreter can run with internet access. Leaving it on when a task does not need it makes it easier for data to leave.
FIXKeep it offline unless the task truly needs the internet.
08No guardrails on inputs
Attackers can hide instructions inside a web page or a document to hijack the agent (prompt injection) or corrupt its memory (memory poisoning).
FIXAdd guardrails and check inputs before the agent trusts them.
09No traces show up
Seeing the agent's step-by-step traces needs a one-time setup in Amazon CloudWatch (Transaction Search). Skip it and the traces are simply missing.
FIXDo the one-time CloudWatch setup first.
10New code, old session
A running session keeps using the code it started with. Deploy new code but reuse the old session id, and you still get the old behavior.
FIXStart a new session (new session id) after an update.
11Memory folders collide
Long-term memories live under folder-like paths (namespaces). A missing trailing slash can make two paths overlap and mix up records.
FIXEnd namespace paths with a "/".
12Confusing tool names
When Gateway turns an API into tools, each tool's name comes from the API's operationId. Vague operationIds produce unclear tool names the model may pick wrongly.
FIXGive APIs clear, specific operationIds.