CloudTech is part of the TechForge Publications seriesView AllAI NewsDeveloperIoT NewsMarketing TechTechHQTech Wire AsiaTelecomsView AllAI NewsDeveloperIoT NewsMarketing TechTechHQTech Wire AsiaTelecomsTechForge SearchCategoriesCloud in ActionCloud MigrationCloud ROI & CostInternal Change ManagementMissteps & LessonsSME & Startup CloudEditorial DeskAnnouncements & AnalysisForecasts & TrendsMigrations: Behind the ScenesTechEx EventsFeaturesInterviewsPodcastsSponsored ContentVideosWebinarsFuture of CloudAI & CloudCloud EthicsEdge & Distributed CloudOpen CloudQuantum & CloudServerless ArchitectureSustainable CloudIndustry PerspectivesEducation & ResearchFinanceHealthcare & Life SciencesLegal & HRMedia, Gaming & CreativePublic SectorRetail & ConsumerMarket IntelligenceCloud StartupsEarnings & Market ShareEvent CoverageMergers & AcquisitionsVendor Roadmaps & LeadershipSecurity, Privacy & TrustCloud CybersecurityCyber Security & Cloud ExpoEncryption & Data PrivacyGovernance, Risk & ComplianceIdentity & AccessStrategy & Decision-MakingChoosing a Cloud StrategyFinOps & BudgetsLock-In & ExitMulti- & Hybrid CloudProcurement & ContractsSkills & HiringTechnology StackBig VendorsContainers & KubernetesDatabases & Data PlatformsInfrastructure as CodeObservability & MonitoringXaaS ModelsEventsResourcesVideo InterviewsPodcastsAll ResourcesMoreEditorial OpportunitiesAbout UsContact Us SearchCategoriesCloud in ActionCloud MigrationCloud ROI & CostInternal Change ManagementMissteps & LessonsSME & Startup CloudEditorial DeskAnnouncements & AnalysisForecasts & TrendsMigrations: Behind the ScenesTechEx EventsFeaturesInterviewsPodcastsSponsored ContentVideosWebinarsFuture of CloudAI & CloudCloud EthicsEdge & Distributed CloudOpen CloudQuantum & CloudServerless ArchitectureSustainable CloudIndustry PerspectivesEducation & ResearchFinanceHealthcare & Life SciencesLegal & HRMedia, Gaming & CreativePublic SectorRetail & ConsumerMarket IntelligenceCloud StartupsEarnings & Market ShareEvent CoverageMergers & AcquisitionsVendor Roadmaps & LeadershipSecurity, Privacy & TrustCloud CybersecurityCyber Security & Cloud ExpoEncryption & Data PrivacyGovernance, Risk & ComplianceIdentity & AccessStrategy & Decision-MakingChoosing a Cloud StrategyFinOps & BudgetsLock-In & ExitMulti- & Hybrid CloudProcurement & ContractsSkills & HiringTechnology StackBig VendorsContainers & KubernetesDatabases & Data PlatformsInfrastructure as CodeObservability & MonitoringXaaS ModelsEventsResourcesVideo InterviewsPodcastsAll ResourcesMoreEditorial OpportunitiesAbout UsContact Us Subscribe Subscribe SearchCategoriesCloud in ActionCloud MigrationCloud ROI & CostInternal Change ManagementMissteps & LessonsSME & Startup CloudEditorial DeskAnnouncements & AnalysisForecasts & TrendsMigrations: Behind the ScenesTechEx EventsFeaturesInterviewsPodcastsSponsored ContentVideosWebinarsFuture of CloudAI & CloudCloud EthicsEdge & Distributed CloudOpen CloudQuantum & CloudServerless ArchitectureSustainable CloudIndustry PerspectivesEducation & ResearchFinanceHealthcare & Life SciencesLegal & HRMedia, Gaming & CreativePublic SectorRetail & ConsumerMarket IntelligenceCloud StartupsEarnings & Market ShareEvent CoverageMergers & AcquisitionsVendor Roadmaps & LeadershipSecurity, Privacy & TrustCloud CybersecurityCyber Security & Cloud ExpoEncryption & Data PrivacyGovernance, Risk & ComplianceIdentity & AccessStrategy & Decision-MakingChoosing a Cloud StrategyFinOps & BudgetsLock-In & ExitMulti- & Hybrid CloudProcurement & ContractsSkills & HiringTechnology StackBig VendorsContainers & KubernetesDatabases & Data PlatformsInfrastructure as CodeObservability & MonitoringXaaS ModelsEventsResourcesVideo InterviewsPodcastsAll ResourcesMoreEditorial OpportunitiesAbout UsContact Us Hamburger Toggle Menu AI & Cloud, Big Vendors, Cloud Computing, Cloud Cybersecurity, Cloud in Action, Features, Future of Cloud, Security, Privacy & TrustAWS AgentCore prompt injection exposes credential risksMuhammad Zulhusni21st September 2026 Share this story: Tags:agentic aiAIAWScloudcybersecuritydataData Managementserverless computingCategories::AI & CloudBig VendorsCloud ComputingCloud CybersecurityCloud in ActionFeaturesFuture of CloudSecurity, Privacy & TrustPalo Alto Networks’ Unit 42 researchers have demonstrated how an indirect prompt-injection attack against AWS’ AgentCore Harness could be used to extract plaintext credentials managed by AgentCore Identity.The researchers said the attack worked with a default Harness configuration, combining malicious instructions embedded in external content with its built-in shell tool.AWS reviewed the disclosure and closed it as informational under the AgentCore shared-responsibility model, according to Unit 42.Amazon Bedrock AgentCore provides infrastructure for deploying and operating AI agents.AgentCore Harness is built on AgentCore Runtime and provides agents with access to capabilities including tools, memory, identity, networking, and external services.AWS documentation states that the Harness includes shell and file_operations as default tools.
The shell can execute Bash commands, while file operations allow agents to view, create, and edit files.Both remain available unless developers restrict them using the allowedTools setting.How the attack workedUnit 42 tested the configuration using a simulated customer support agent that processed support tickets and connected to an external Model Context Protocol (MCP) server.The MCP service was authenticated using a credential stored through AgentCore Identity.Researchers inserted hidden instructions into a support ticket to perform an indirect prompt-injection attack.
They said the manipulated agent invoked the built-in shell and executed code inside the Harness environment.During testing, Unit 42 found that the shell process was running as root and could read memory belonging to the Harness runtime process.The researchers then examined whether credentials retrieved through AgentCore Identity were present in that memory.AgentCore Identity allows credentials used for external services to be stored separately from an agent’s application code.In Unit 42’s test, the credential was stored in AgentCore Identity and referenced by its Amazon Resource Name rather than being kept directly by the user.Unit 42 said the credential was protected while stored and transmitted but was resolved into a usable form when the Harness authenticated to the MCP server.
Researchers found the resulting JSON Web Token (JWT) in plaintext in runtime process memory accessible from the shell.Unit 42 extracted the token and corresponding MCP server address before sending both to a simulated attacker-controlled endpoint.Researchers then replayed the token from a separate system without using AWS credentials.In the test environment, the token allowed access to tools on the simulated MCP server, including a customer lookup function containing test personally identifiable information.The test also involved separate permissions for the caller and the Harness.Unit 42 said the caller was authorised to invoke the Harness, while the recovered credential belonged to an operator-configured mcp-service account used by the Harness to access the downstream MCP server.AWS addresses this type of permission separation in its AgentCore guidance.
It advises customers to configure AgentCore execution roles with equal or fewer privileges than the users able to invoke the resource to avoid privilege escalation.AWS also recommends applying least-privilege permissions to execution roles.AgentCore Runtime separately isolates sessions using dedicated microVMs with their own compute, memory, and filesystem resources.AWS warns, however, that code or actors running inside an AgentCore microVM can access temporary execution-role credentials provided through its metadata service.Unit 42 did not demonstrate an escape into another AgentCore session.
Its attack operated within the authorised Harness session, where the researchers said the shell and Harness runtime shared the same user identifier and the shell could read the runtime process memory.The proof of concept instead relied on capabilities available within that session.The injected instructions led the model to select the shell tool, which executed code inside the runtime and accessed the process in which the downstream credential had been resolved.Outbound network access was then used to send the recovered data to an external endpoint.AWS documentation states that input validation and prompt-injection prevention are customer responsibilities under the AgentCore Harness shared-responsibility model.
The Harness validates the structure of incoming requests but does not inspect the meaning of prompts or enforce behavioural restrictions on the agent.Similar risks involving tool-enabled agents have also been tested outside AgentCore.NIST’s Center for AI Standards and Innovation has examined what it calls “agent hijacking,” in which malicious instructions are placed in data consumed by an agent.In its evaluations, NIST gave an agent command-line access to a Linux environment and tested whether injected instructions could trigger actions including downloading and executing software or exfiltrating cloud data.NIST reported that the tested agent was frequently induced to follow malicious instructions in the tested scenarios.AWS shared responsibility modelUnit 42 reported the issue to AWS Security in May this year.
AWS responded in early June before merging the disclosure with an earlier report and closing it as informational on June 10, according to the researchers’ disclosure timeline.Unit 42 said AWS cited allowedTools scoping and network egress controls as measures customers can use to limit the attack path.AWS documentation states that the company is responsible for areas including microVM isolation, operating system patching, managed Harness runtime code, network infrastructure security, and service availability.Customers are responsible for IAM policies, commands executed inside runtime sessions, input validation, agent code security, and network configuration.AWS also states that the Harness shares the same trust boundary as AgentCore Runtime rather than creating an additional security boundary between the caller and the microVM.Principals that pass the IAM or JWT authentication and authorisation checks can reach the tools and capabilities configured for that Harness.AWS recommends validating and sanitising messages at the application layer when a Harness is exposed to users or integrations that are not fully trusted.
Its documentation also recommends restricting the tools and model configuration fields exposed to callers.Outbound network access was another part of Unit 42’s proof of concept.Researchers sent the recovered JWT and MCP server address from the Harness environment to a simulated attacker-controlled webhook.AWS says Harness sessions use the public network by default.Customers can instead deploy them in VPC mode, where security groups and other VPC controls can restrict which resources the runtime and its tools can reach.AWS Security Hub includes a high-severity control recommending VPC network mode for AgentCore runtimes and marks runtimes configured for public network mode as failing the check.
AWS says VPC mode allows traffic to be governed through controls including security groups, network access control lists, and VPC Flow Logs.AWS and NIST also document controls around the identities and credentials used by agents.NIST said in August 2026 that agents should have their own identifiers, credentials, and entitlements tied to the user or system operating them.It also warned that another party can use a bearer token if that token is obtained.AWS similarly recommends using AgentCore Identity for outbound authentication rather than embedding third-party credentials in agent code or logs.
Its guidance also distinguishes credentials delegated by users from credentials assigned to agents operating independently.Unit 42 recommends restricting the built-in tools available to each Harness session, limiting the privileges assigned to service accounts stored through AgentCore Identity, and monitoring outbound network traffic from Harness environments.See also: AWS cloud data loss in Bahrain and UAE raises resilience questionsWant to learn more about Cloud Computing from industry leaders? Check out Cyber Security & Cloud Expo taking place in Amsterdam, California, and London.The comprehensive event is part of TechEx and is co-located with other leading technology events, click here for more information.CloudTech News is powered by TechForge Media.Explore other upcoming enterprise technology events and webinars here.About the Author Muhammad ZulhusniJournalist As a tech journalist, Zul focuses on topics including cloud computing, cybersecurity, and disruptive technology in the enterprise industry.
He has expertise in moderating webinars and presenting content on video, in addition to having a background in networking technology.Related AWS cloud data loss in Bahrain and UAE raises resilience questions18th September 2026 Why cloud resilience is failing in the modern era17th September 2026 UAE redesigns 5GW AI data centre plan around physical security14th September 2026 Microsoft reportedly targets 38GW of data centre capacity by 203211th September 2026 AWS cloud data loss in Bahrain and UAE raises resilience questions18th September 2026 Why cloud resilience is failing in the modern era17th September 2026 UAE redesigns 5GW AI data centre plan around physical security14th September 2026 Microsoft reportedly targets 38GW of data centre capacity by 203211th September 2026 Join our CommunitySubscribe now to get all our premium content and latest tech news delivered straight to your inbox Click here Popular XaaS ModelsSoftLayer beefs up its bare metal offering, available on hourly basis 43594 view(s)Cloud ROI & Cost, Interviews, Sponsored Content, Sustainable CloudRipple effect: Xylem’s sustainable water solutions for Europe’s data centres 20747 view(s)Cloud Computing, XaaS ModelsConcern over cloud storage security remains says Spiceworks – but good news for OneDrive 12756 view(s)Big Vendors, Cloud Computing, Cloud Cybersecurity, Market Intelligence, Security, Privacy & Trust10 real-life cloud security failures and what we can learn from them 7267 view(s)XaaS ModelsSoftLayer beefs up its bare metal offering, available on hourly basis 43594 view(s)Cloud ROI & Cost, Interviews, Sponsored Content, Sustainable CloudRipple effect: Xylem’s sustainable water solutions for Europe’s data centres 20747 view(s)Cloud Computing, XaaS ModelsConcern over cloud storage security remains says Spiceworks – but good news for OneDrive 12756 view(s)Big Vendors, Cloud Computing, Cloud Cybersecurity, Market Intelligence, Security, Privacy & Trust10 real-life cloud security failures and what we can learn from them 7267 view(s) See all Latest View All Latest Features14th September 2026UAE redesigns 5GW AI data centre plan around physical security AI & Cloud11th September 2026Microsoft reportedly targets 38GW of data centre capacity by 2032 AI & Cloud9th September 2026Amazon and Qualcomm expand AI data centre chip deal for AWS Features14th September 2026UAE redesigns 5GW AI data centre plan around physical security AI & Cloud11th September 2026Microsoft reportedly targets 38GW of data centre capacity by 2032 AI & Cloud9th September 2026Amazon and Qualcomm expand AI data centre chip deal for AWS SubscribeAll our premium content and latest tech news delivered straight to your inbox Subscribe ExploreAbout UsContact UsNewsletterPrivacy PolicyCookie PolicyAbout UsContact UsNewsletterPrivacy PolicyCookie PolicyReach Our AudienceAdvertisePost a Press ReleaseContact UsAdvertisePost a Press ReleaseContact UsCategoriesCloud in ActionEditorial DeskFeaturesFuture of CloudIndustry PerspectivesMarket IntelligenceSecurity, Privacy & TrustTechnology StackStrategy & Decision-MakingAll CategoriesCloud in ActionEditorial DeskFeaturesFuture of CloudIndustry PerspectivesMarket IntelligenceSecurity, Privacy & TrustTechnology StackStrategy & Decision-MakingAll CategoriesOther PublicationsExplore AllAI NewsDeveloperIoT NewsMarketing TechTechHQTech Wire AsiaTelecomsExplore AllAI NewsDeveloperIoT NewsMarketing TechTechHQTech Wire AsiaTelecomsCloudTech News is part of TechForge SubscribeAll our premium content and latest tech news delivered straight to your inbox
Read More
