Amazon Web Services (AWS) has found itself grappling with a series of security vulnerabilities in its autonomous agents, as highlighted by findings from cybersecurity experts at Palo Alto Networks’ Unit 42 and Zenity Labs. Despite AWS's prompt responses to reported issues, the underlying challenge lies in the inherent risks associated with autonomous AI agents and the difficulty in maintaining effective controls over their actions.
Understanding the AgentCore Vulnerabilities
On September 18, 2026, Unit 42 researchers uncovered a significant vulnerability in AWS's AgentCore Harness. This flaw permitted attackers to manipulate agent actions through prompt injection, potentially exposing plaintext credentials managed by AgentCore Identity. The very capabilities that enable these agents to function autonomously also create considerable security vulnerabilities.
According to the report, the built-in shell tool within the harness operates with root access, which raises serious security concerns. An attacker could execute commands with the same level of access, effectively bypassing necessary safeguards. The default configurations not only allow for operational efficacy but inadvertently open backdoors for exploitation.
Despite Unit 42's active disclosures, AWS's response left uncertainty regarding whether the issues had been fully resolved. The company's statement indicated that it had closed the report as informative, but specifics on actionable fixes were less clear.
Credential Exposure and Privilege Escalation
Earlier in the year, a different vulnerability involving agent credential exfiltration had already been brought to AWS's attention. Unit 42 reported a flaw in the microVM Metadata Service (MMDS) used by AgentCore Runtime, which lacked essential session token enforcement. This oversight could allow attackers to exploit common web vulnerabilities, such as server-side request forgery (SSRF), to extract sensitive credentials, jeopardizing the entire environment.
In a recent development, Zenity Labs published a detailed examination of the AgentCore's security limitations, noting that they successfully extracted a complete set of temporary security credentials from an agent. Notably, these credentials were not restricted to a sandbox environment, highlighting the perils associated with improper isolation practices.
Zenity pointed out that an agent returned critical information, including read permissions for ECR, giving the researchers the ability to pull source code and dependencies with root access. This demonstrated a fundamental issue at the platform level: the isolation failures allowed a chain reaction of credential exposures.
The Patching Puzzle
Uncertainties about the effectiveness of AWS's patching efforts persist. Zenity reported numerous vulnerabilities discovered as early as late 2025, with AWS issuing a patch in February 2026. However, even after these updates, many concerns lingered about the overall effectiveness in sealing the vulnerabilities. A recent email from Tamir Ishay Sharbat of Zenity indicated that while AWS had addressed some permission issues by October 8, earlier patches did not fully rectify all of the existing security holes.
When discussing the inherent conflict between agent autonomy and security, Zenity's CTO conducted an insightful analysis, suggesting that organizations need to account for the complexities that arise when balancing operational capabilities with secure agent design. The feedback implies a critical need for tighter access controls against the backdrop of autonomous functionality.
Security Considerations and Best Practices
Amid the ongoing issues, cybersecurity professionals are emphasizing the importance of re-evaluating access controls, especially concerning default permissions in cloud environments. Analysts warn enterprises to implement strict least-privilege policies while mindful that relying too heavily on default settings can lead to significant risk.
Frank Dickson, a principal analyst, raised concerns regarding the memory issues cybersecurity teams must contend with. As he pointed out, a compromised agent might still pose a threat long after credentials expire, making it increasingly challenging for organizations to secure their IT environments.
As enterprise stakeholders ponder best practices for managing agent vulnerabilities, they should consider proactive measures that include restricting unvetted agent interactions and establishing strong egress controls. Implementing stringent policies can mitigate risks that arise from shared environments while enhancing the overall security posture.
The Bigger Picture: Recognizing Agent Functionality vs. Security
The gravity of AWS's predicament is that agents are operating precisely as designed. As Kale noted, accessing credentials from the metadata service is a fairly standard vulnerability, and what's alarming is that it can happen without the existence of a software bug—simply through straightforward prompts.
The insights from these research findings serve as a clarion call for cybersecurity leaders to reassess their security frameworks and reinforce defenses. It’s imperative they understand not just how agents operate, but what vulnerabilities they inherently introduce into cloud environments.
Justin Greis, CEO of Acceligence, stressed the importance of controlling data access across platforms, particularly in light of the expansive risk that accompanies compromised agents. Organizations must ask critical questions regarding what resources agents can reach and what subsequent actions may result from a single credential compromise.
Ultimately, as automation and artificial intelligence continue to evolve within cloud solutions, organizations must remain vigilant. Embracing rigorous security practices to safeguard against potential exploitation of autonomous agents will be vital to maintaining trust and integrity in cloud-based services.
