Researchers highlight persistent AWS AgentCore security flaws in default configurations
Palo Alto Networks and Zenity Labs report that AWS AgentCore default settings allow credential exfiltration via prompt injection, illustrating broader AI agent risks.
Key points
- Default configurations in AWS AgentCore Harness allow attackers to steal plaintext credentials.
- The built-in shell tool runs as root, inheriting full access when an agent executes commands.
- AWS closed the latest report as informative under its shared responsibility model.
Cybersecurity researchers from Palo Alto Networks’ Unit 42 and Zenity Labs reported on September 18, 2026, that default configurations in Amazon Web Services’ AgentCore Harness enable attackers to exfiltrate plaintext credentials. The findings highlight persistent security challenges associated with autonomous AI agents, which require broad access to perform tasks but thereby create significant exposure vectors for malicious actors.
The vulnerability arises because the harness’s built-in shell tool, enabled by default, operates within the same memory space where credentials are resolved to plaintext. According to the Unit 42 report, this tool runs as root inside the harness. Consequently, any command an attacker forces the agent to execute inherits root privileges. This risk exists in the out-of-the-box state without requiring any specific misconfiguration by the user.
Context and Background
This incident represents one of several security issues Amazon Web Services has addressed throughout 2026 regarding autonomous agent controls. Researchers noted that while AWS reacts quickly to security reports, similar vulnerabilities have reemerged in slightly different forms. The core difficulty lies in controlling agents that must have extensive permissions to function autonomously, a challenge that extends beyond AWS to enterprise IT and cybersecurity executives broadly.
Several months earlier, on April 7, Unit 42 alerted AWS to a different credential exfiltration path. That issue involved a critical security regression in the AgentCore Runtime, which used a microVM Metadata Service lacking session token enforcement. The repeated nature of these flaws suggests that the fundamental architecture of agentic systems presents ongoing security hurdles that are difficult to resolve completely through patching alone.
Who Is Affected
The primary impact falls on organizations using AWS AgentCore Harness with default settings. Because the shell tool is enabled by default and runs as root, any deployment that does not explicitly modify these configurations is exposed. The vulnerability allows attackers to steer agent actions through prompt injection, leading to the theft of credentials managed by AgentCore Identity. This affects any enterprise relying on these autonomous agents for operational tasks without implementing additional restrictive controls.
AWS responded to the September disclosure by reviewing the finding and closing the report as informative. The cloud provider cited the AgentCore shared responsibility model in its response. This classification implies that the security burden for configuring these tools appropriately rests with the customer, rather than being a software defect requiring a vendor-side patch.
What should you do?
Organizations using AWS AgentCore should immediately review their harness configurations to ensure default shell tools are disabled or restricted. Administrators must verify that agents do not run with root privileges unless absolutely necessary for their specific functions. Monitoring agent behavior for unexpected command executions can help detect prompt injection attempts early. Security teams should also audit previous deployments for similar regressions, such as missing session token enforcement in metadata services.
Background: Prompt injection attacks
Look for sudden shifts in tone, refusal to follow system constraints, or output that repeats hidden instructions. These signs indicate the model is processing injected commands rather than your intended query.
Read the full guide: Prompt Injection Warning Signs: How to Spot AI Manipulation
What to do and how to stay safe: AWS
- Disable the built-in shell tool in AWS AgentCore Harness if it is not strictly required for your agent's tasks.
- Ensure that agents do not run with root privileges; restrict permissions to the minimum necessary for operation.
- Monitor agent logs for unexpected command executions or access attempts to credential management services.
- Review all AgentCore deployments for session token enforcement in metadata services to prevent similar regressions.
Step-by-step guide: Cloud Misconfiguration Response: Containment, Recovery and Prevention Steps
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does AWS provide a patch for the AgentCore Harness credential exfiltration issue?
AWS closed the report as informative under its shared responsibility model, indicating no vendor patch was issued.
What allows attackers to steal credentials from AWS AgentCore?
The built-in shell tool runs as root and accesses the same memory space where plaintext credentials are resolved.
Has AWS had similar security issues with AgentCore before?
Yes, researchers reported a critical regression in April 2026 involving missing session token enforcement in the runtime.
