Loading story…
Unit 42 found that AWS AgentCore Harness’s default-enabled shell and file_operations tools can let an indirect prompt injection achieve arbitrary command execution inside an agent runtime. In testing, the shell ran as root and read memory from the root-owned harness runtime, exposing a plaintext Amazon Cognito JWT that AgentCore Identity had resolved for a simulated MCP service account; researchers replayed the token remotely to access simulated customer PII.
AWS classified the May 2026 report as informative under its shared-responsibility model, pointing to customer-managed controls including allowedTools scoping and egress filtering. Organizations using AgentCore Harness should restrict permitted tools for each invocation, apply least privilege to Identity-vault service accounts, and monitor outbound network traffic from harness containers for credential exfiltration or token replay activity.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
AWS merged report #3747844 with earlier report #3737800 and closed it as informative under the AgentCore shared-responsibility model. AWS identified allowedTools scoping and egress filtering as customer-side controls.
AWS requested additional reproduction and scope clarification for Unit 42's AgentCore Harness report.
Unit 42 reported a prompt-injection-driven credential-exfiltration risk in default AWS AgentCore Harness deployments to AWS Security through HackerOne as report #3747844.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Research from Novee Security found that default AI agent harnesses from major vendors could be abused to exfiltrate secrets, bypass trust boundaries, and chain individually approved actions into harmful outcomes. Elad Meged reported multiple issues affecting Anthropic, Google, and OpenAI tooling, arguing that the root problem lies in architectural trust decisions, approval logic, and cross-stage handoffs rather than prompt injection alone. One Google Gemini CLI issue was tracked as **`GHSA-wpqr-6v78-jr5g`** with a **CVSS 10.0** rating, while weaknesses were also identified in Anthropic's Claude Code Action and OpenAI's Codex CLI sandbox. The findings showed how controls can fail when agent components such as tools, memory, prompts, and execution environments trust each other too broadly. Researchers said Google's agent could be pushed into a supply-chain-style attack that wrote to its own GitHub repository, illustrating how safe-looking steps can combine into exploitable workflows. Vendors have added mitigations and fixes, but the repeated pattern across products points to a broader industry problem for organizations deploying autonomous agents on untrusted input, especially where human review is limited or absent.
Jul 31, 2026
An empirical review of 3,171 public GitHub repositories found confirmed security defects in **16.0%** of AI coding-agent harness configurations. The review covered 2,660 multi-component agent setups and 511 published skill collections, assessing instruction files, skills, hooks, subagents, and Model Context Protocol (MCP) server declarations. The most common issues were unpinned MCP server versions, overly broad execution pre-approvals, and skills that pre-authorized shell access for installers; researchers did not confirm a credential-exfiltration path. The harness surrounding a coding model—its prompts, tools, skills, MCP servers, and orchestration—creates a material supply-chain and prompt-injection attack surface. Mutable remote MCP services, trusted prompt formatting, YAML skill metadata, and self-propagating payloads such as CopyPasta can be abused to influence agent actions. Organizations should inventory harness trust relationships, enforce least privilege and human approvals, pin and validate external components, independently monitor runtime behavior, and assign governance and incident-response ownership for agentic AI.
Sep 11, 2026
Security researchers and vendors warned that autonomous AI agents can be manipulated into leaking secrets and misusing privileged access, turning them into a new pathway for credential theft and system compromise. Reporting from SC Media cited Okta Threat Intelligence research showing agents on the OpenClaw platform could be socially engineered or prompt-injected into exposing passwords, API keys, GitHub tokens, and OAuth refresh tokens, while other analysis described a **confused deputy** problem in which malicious text embedded in files, logs, web pages, or instruction files causes agents to execute higher-trust actions with their legitimate permissions. The risk is amplified when agents can read local files, edit code, run commands, fetch remote content, and access external tools or MCP servers without strong separation between trusted instructions and untrusted data. Defenders are responding with controls aimed at limiting agent authority and reducing secret exposure. Help Net Security reported on **Nono**, an open-source sandbox that constrains AI coding agents at the kernel level using mechanisms such as **Landlock** on Linux and **Seatbelt** on macOS, while introducing scoped tool permissions and proxy-mediated "phantom credentials" so agents do not directly handle live secrets. The broader guidance aligns with established ATT&CK techniques including **`T1552` Unsecured Credentials** and **`T1546` Event Triggered Execution**, emphasizing least privilege, centralized identity governance, short-lived credentials, secure secret storage, logging, rapid revocation, provenance checks, input isolation, and human approval to prevent agents from becoming a bridge to sensitive systems and cloud resources.
Jul 28, 2026