Security researchers have discovered that AI agents running on Amazon Web Services (AWS) can be manipulated into exposing sensitive credentials, raising fresh concerns about the security of agentic AI platforms. Their findings show that even encrypted secret-management systems may not prevent attackers from stealing valuable tokens, passwords, and API keys when AI agents are granted broad operational access.
The research, conducted by Palo Alto Networks' Unit 42 team, focused on AWS AgentCore, a platform designed to simplify the deployment and management of AI agents. Although AgentCore includes a secure credential vault intended to protect sensitive information, researchers demonstrated that attackers could still trick AI agents into revealing secrets in plaintext through prompt injection techniques.
According to AWS, customers are responsible for configuring access controls and restricting the permissions available to AI agents. However, researchers noted that under default configurations, agents can possess enough privileges to unintentionally disclose highly sensitive credentials during normal task execution.
Why Encrypted Secrets Remain Vulnerable
Modern AI agents must interact with tools, files, cloud services, and external applications to perform meaningful work. AWS provides this functionality through AgentCore Harness, a managed runtime environment that enables agents to execute commands and interact with connected resources. By default, the platform includes a shell tool, allowing agents to run system-level commands.
Sensitive credentials such as authentication tokens, API keys, and passwords are stored within AgentCore Identity, AWS's encrypted secrets vault. While the credentials remain encrypted at rest, the challenge emerges when the agent needs to use them.
To authenticate with services, the AI agent must access the plaintext version of the secret during runtime. Researchers found that because these credentials are ultimately loaded into the agent's running process, they become accessible to an attacker who gains sufficient influence over the agent's actions.
In essence, encrypted secrets remain secure while stored, but once they are actively used by the AI agent, the information must be decrypted and made available in memory, creating an opportunity for compromise.
Prompt Injection Attack Demonstrates Credential Theft
To test the platform's resilience, researchers deployed an AI agent powered by a model capable of using external tools and instructed it to process customer support requests for a simulated organization.
One support ticket was intentionally poisoned with a malicious prompt disguised as a legitimate diagnostic procedure. The ticket directed the agent to execute a specially crafted Python script under the guise of a system health check.
The attack proved highly effective.
After processing the ticket, the AI agent executed the malicious code and transmitted sensitive data through an outbound HTTP request. The exfiltrated information included:
- A JSON Web Token (JWT)
- The URL of a connected MCP server
- Authentication details used by backend services
Researchers noted that the stolen JWT was far more valuable than a standard user credential. Instead, it functioned as a high-privilege authentication token that could provide access to multiple services connected to the AI agent.
The compromise demonstrated how a single prompt injection attack could transform an AI assistant into an unintended insider capable of leaking critical organizational secrets.
The Real Danger Lies in Tool Access
The findings underscore a broader security challenge affecting agentic AI systems.
Researchers emphasize that the primary risk is not necessarily the language model itself, but the powerful tools attached to it. Once a malicious instruction reaches an AI agent, attackers may gain indirect access to everything available through the agent's toolset, including:
- Local file systems
- Network connections
- Process memory
- Cloud services
- Internal applications
- External integrations
Because AI models cannot consistently distinguish between legitimate instructions and maliciously injected commands, security boundaries are ultimately determined by the permissions granted to the agent rather than by the model's judgment.
In practical terms, if an AI agent can access sensitive resources, attackers may eventually find ways to coerce it into exposing those resources.
Recommended Defenses
Unit 42 researchers recommend a layered approach to securing AI agents and minimizing the impact of prompt injection attacks.
Key defensive measures include:
Restrict Agent Capabilities
Disable tools and functions that are not required for the agent's intended purpose. Fewer available tools mean fewer opportunities for abuse.
Apply Least-Privilege Access
Limit credentials so they only grant access to the specific resources needed for each task. Avoid giving AI agents broad administrative permissions.
Monitor Outbound Communications
Track network traffic generated by AI agents to identify suspicious destinations, unexpected uploads, or unauthorized data transfers.
Limit Shell Access
Where possible, reduce or remove shell execution capabilities, which significantly expand the range of actions an attacker can perform through prompt injection.
Audit Connected Services
Regularly review the services, APIs, and data sources connected to AI agents to ensure access remains appropriate and tightly controlled.
Growing Security Concerns Around Agentic AI
The research highlights a fundamental challenge facing the next generation of autonomous AI systems. While encrypted vaults, identity management systems, and authentication controls remain essential security measures, they cannot fully protect organizations if an AI agent is granted broad authority and can be manipulated into misusing its own permissions.
As enterprises increasingly deploy AI agents to automate business operations, cloud administration, and customer support workflows, security teams will need to treat prompt injection as a serious threat vector. Protecting agentic environments will require strict permission controls, continuous monitoring, and an assumption that any connected tool may eventually become a target for abuse.
The key takeaway is clear: encrypted secrets are only as secure as the systems that are allowed to access them. If an AI agent can retrieve a secret, an attacker may be able to convince the agent to retrieve it as well.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
