AWS AI Agent Tool Could Let Attackers Steal Credentials via Prompt Injection

Researchers at Unit 42 have identified a security gap in AWS AgentCore Harness, a managed environment businesses use to run AI agents. The issue centres on a built-in shell tool that is switched on by default. This tool operates in the same memory space where AgentCore Identity temporarily decrypts stored credentials so they can be used. Researchers found that an attacker could use prompt injection, tricking the AI agent through malicious instructions hidden in its inputs, to make the agent access and exfiltrate those plaintext credentials.

AgentCore Identity is designed with strong protections, including encryption at rest and in transit, managed encryption keys, and access controls. However, these protections apply to credentials while stored, not necessarily at the moment they are decrypted for use. Unit 42 reported the finding to AWS, which reviewed it and closed the report as informative, pointing to existing customer-side controls such as restricting which tools an agent can use (allowedTools) and filtering outbound network traffic (egress filtering) as the appropriate defences.

This means the responsibility for closing the gap largely falls on businesses deploying AI agents on this platform. Because the shell and file-editing tools are enabled by default in every session, organisations that have not explicitly restricted them may be exposing credential material to unnecessary risk without realising it.