Security researchers have demonstrated how AWS AI agents can leak sensitive credentials through prompt injection. The attack succeeded even though the platform stored the secrets inside an encrypted vault.
Researchers Extract Credentials From AgentCore
Palo Alto Networks’ Unit 42 discovered the security risk in AWS AgentCore.
The researchers created a prompt-injection attack that caused an AI agent to reveal protected credentials. They then disclosed their findings to AWS.
AWS reviewed the submission and closed it as informative. The company says customers must control which tools and resources their agents can access.
However, the default configuration can allow an agent to expose secrets.
AgentCore Gives AI Agents Powerful Tools
AWS AgentCore provides a managed environment for deploying agentic AI applications.
AI agents need access to files, tools and external services to perform useful tasks. They may also need permission to run system commands.
AgentCore Harness manages these capabilities and includes a shell tool by default.
Meanwhile, AgentCore Identity stores passwords, tokens and API keys inside an encrypted vault. This protection secures credentials while they remain stored.
However, agents must decrypt a credential before using it to authenticate with a connected service. The secret therefore appears temporarily in the runtime’s process memory as plain text.
Shell Tool Can Read Process Memory
Unit 42 found that the agent operated with root privileges inside its isolated environment.
As a result, the built-in shell tool could access the memory of the main AgentCore Harness process.
When the harness needed a credential, it resolved the credential reference into the actual secret. That operation took place inside Process ID 1.
Because the shell could read that process memory, an attacker could potentially extract the decrypted credential.
Therefore, encryption at rest could not prevent exposure after the agent retrieved the secret for legitimate use.
Malicious Support Ticket Triggers Data Theft
The researchers tested the risk by asking an AI agent to process support tickets for a fictional company.
They selected a permissive model that supported tool calling. Then, they inserted a malicious instruction into one of the tickets.
The hidden prompt told the agent to run a crafted Python script as a diagnostic health check.
The agent followed the instruction without recognising it as malicious. A single HTTP POST request then sent a JSON Web Token and an MCP server address to a simulated attacker.
The leaked token served as a persistent master credential for the agent. It could unlock every backend service connected to that agent.
Prompt Injection Expands Through Connected Tools
The research highlights a wider security problem for agentic AI systems.
A successful prompt-injection attack can compromise everything an agent’s shell can reach. This access may include files, network connections, process memory and downstream services.
Restricting the shell can reduce the potential impact. However, those restrictions can also remove capabilities that make the agent useful.
Researchers warned that AI models cannot reliably separate legitimate instructions from injected commands. Therefore, tool permissions determine the potential damage more effectively than the model’s reasoning.
Organisations Should Limit Agent Permissions
Unit 42 recommends disabling every tool that an AI agent does not need.
Organisations should also apply least-privilege controls to every credential. Each token or API key should provide access only to the resources required for a specific task.
Furthermore, security teams should monitor outbound traffic from agent environments. This monitoring can reveal suspicious data transfers and unexpected destinations.
The findings show that encrypted vaults alone cannot fully protect credentials from compromised AWS AI agents. Strong access controls and restricted tools remain essential.
0 responses to “AWS AI Agents Can Leak Stored Credentials”