AI agents on AWS can access and leak secrets, researchers warn

AWS offers an easy-to-deploy agentic AI platform. But its secure, encrypted credentials vault won’t stop a helpful AI assistant from exfiltrating and handing secrets to attackers in plain text, researchers at Palo Alto Networks’ Unit 42 have found.

AI agents on AWS’s easy-to-deploy platform, AgentCore, can leak sensitive credentials to attackers.

Unit 42 researchers demonstrated a prompt-injection attack in which they managed to steal credentials from the platform despite the use of an encrypted vault intended to keep secrets secure.

“We disclosed this finding to AWS. AWS reviewed and closed the report as informative,” the researchers noted in a report.

AWS argues that it’s up to customers to lock down the settings for what AI agents can use and access. In the default configuration, leaking secrets is possible.

How can encrypted keys leak in plain text?

An AI agent is only useful if it can access files, tools, integrations with external services, and run commands. AWS’s managed runtime for AI agents, AgentCore Harness, handles that and comes with a built-in shell tool by default.

To protect the login credentials used by AI agents, such as tokens, passwords, and API keys, AWS encrypts and stores them in the vault called AgentCore Identity.

However, there’s an issue: root. It’s what the AI agent sees when it runs ‘whoami,’ a command that prints the current user's username.

The AI agent has complete unrestricted access to the otherwise isolated system.

When an AI agent needs to use an actual credential for authentication, the secret is temporarily decrypted and stored in memory in plain text. The shell tool can access the same memory region where the secrets are stored.

“For the harness to authenticate with a credential stored in that vault, the ARN (Amazon Resource Name) first needs to be resolved into the real plaintext secret. That resolution must happen at runtime, inside its process. In this case, that’s PID 1 (Process ID 1), whose memory we can already read,” the report explains.

To demonstrate exfiltration in practice, the researchers chose a “more permissive model” that supports tool calling and tasked it with resolving support tickets for a fake company.

“It did exactly what we asked.”

The researchers poisoned one “ticket” with a malicious prompt, pointing to run a crafted Python script as a “diagnostic health check.”

It took just a moment for the AI agent to process the ticket – a single HTTP POST request leaked a JSON Web Token (JWT) and the URL to the MCP server to the simulated attacker’s server.

This JWT credential isn’t something a regular user uses – it’s a permanent master key for the AI agent to unlock every backend service it’s connected to. MCP is a connector standard that lets AI agents wire into multiple tools and data sources.

The research highlights a broader agentic AI challenge: prompt injection attacks can compromise everything the shell tool can access, including the file system, network, process memory, and downstream services. Scoping the shell down also strips the agent of many capabilities.

Unit 42 recommends turning off tools the AI agent doesn’t need, limiting what each login key can do to “least privilege,” and monitoring outbound traffic to see what the AI agent is sending and where.

“The model’s reasoning can’t reliably distinguish a legitimate instruction from an injected one, so it’s the shell tool’s reach that bounds what an attacker can do, not the model’s judgment,” the researchers concluded.