Unit 42 finds credential leak path in AWS AgentCore Harness

Researchers at Unit 42, the threat intelligence arm of Palo Alto Networks, published findings on 18 September 2026 describing how default configurations in AWS AgentCore Harness can allow prompt injection attacks to exfiltrate credentials from AI agents.

AgentCore Harness is part of Amazon's tooling for running AI agents. According to Unit 42, the problem sits in what the researchers call the uncomfortable space between the harness and identity management. In the default setup, the agent runtime and the identity layer that holds credentials are not tightly coupled, and that gap is what an attacker can work with.

Prompt injection is an attack where instructions hidden in data the agent reads, such as a web page, a document or a tool response, are treated by the model as commands from its operator. Unit 42's analysis describes how an injected instruction can be used to pull credentials out of the agent and send them somewhere the attacker controls. The researchers published the work as an analysis with recommended steps for securing agents, rather than as a report of an attack seen in the wild.

Unit 42 did not describe the issue as a flaw in a single component that needs patching. The framing in the published analysis is about configuration: the defaults are permissive enough that a credential leak is possible, and operators need to change them. The company set out key steps it says teams should take to secure their agents. No exploitation against real customers is reported in the published material.

The pattern is a familiar one for anyone running agents in production. An agent is given credentials so it can call tools and services on a user's behalf. The same agent also consumes untrusted text. If the boundary between those two things is loose, the credentials become reachable by whoever controls the text. Unit 42's contribution here is to show that a mainstream managed agent platform ships with that boundary set in a way that can be abused.

AWS has not published a response in the material reviewed. The severity of the issue has not been given a public score in the source, and the researchers did not attribute the design choice to any particular intent.

Teams running agents on AgentCore Harness should read the Unit 42 write-up and compare its hardening advice against their own deployment, paying particular attention to how credentials are scoped and how far an agent's identity reaches beyond the task it is performing. The broader lesson stands regardless of platform: an agent that can read untrusted input should not hold credentials it does not need, and it should not be able to reach the store where those credentials live.