Exploring the Security Challenges of Autonomous AI Agents in AWS

In recent months, Amazon Web Services (AWS) has grappled with substantial security vulnerabilities in its autonomous agent systems, prompting rapid responses and ongoing challenges. Reports from experts at Palo Alto Networks' Unit 42 and Zenity Labs reveal that flaws in the design of AI agents continue to re-emerge, indicating a persistent issue for even the most resourceful cloud providers.

Understanding the Agentic Security Flaws

On September 18, 2026, Unit 42 uncovered a significant vulnerability within AWS's AgentCore Harness that could potentially allow attackers to manipulate an agent’s actions through prompt injection. The flaw centers around default configurations that let unauthorized users exfiltrate plaintext credentials managed by the AgentCore Identity. This situation starkly illustrates a fundamental issue: the very design attributes meant to empower agents in performing their tasks also open avenues for exploitation.

The report described how the built-in shell tool enabled by default compromises security by accessing the memory space where sensitive data is resolved into plaintext. The root-level access that this shell provides implies that if an attacker can execute any command, it inherits complete control over the environment. This alarming vulnerability does not stem from misconfigurations, but rather from the system's out-of-the-box state, leaving organizations vulnerable right from deployment.

Amazon's reaction to these findings has been somewhat vague, with indications that the issues might not have been entirely resolved. “We disclosed this finding to AWS. AWS reviewed and closed the report as informative under the AgentCore shared responsibility model,” stated the analysis from Unit 42.

Recurring Credential Exfiltration Issues

Earlier, on April 7 of the same year, Unit 42 also reported a different method of credential exfiltration involving a lack of session token enforcement in the AgentCore Runtime’s microVM Metadata Service. Before patches were implemented, it allowed an attacker to leverage common web vulnerabilities to extract sensitive credentials, posing a substantial risk to the overall environment.

Subsequently, Zenity Labs published findings indicating that an attacker could successfully obtain a full set of temporary STS credentials from an AWS agent. The data extracted included access keys and session tokens that were capable of gaining unbounded access to various AWS services, raising serious concerns about the platform's isolation mechanisms. While the incident exposed an alarming breach of trust in data handling, the underlying infrastructure weaknesses remained firmly in place.

The Patch Status and its Implications

The ambiguity surrounding the resolution of these vulnerabilities remains a pressing concern. Zenity's report detailed a timeline of their investigations leading up to a disclosure on December 25, 2025, followed by AWS communicating updates in February 2026. However, evidence suggests that even after the updates, vulnerabilities persisted, highlighting the complexities of maintaining robust security in an agentic environment.

As of October 8, Zenity confirmed that AWS had rectified specific permission issues, but past communications raised doubts about whether all vulnerabilities had been effectively addressed. According to Tamir Ishay Sharbat, Zenity's director of security research, past efforts to fix these problems did not resolve all key issues. The existing roles still retained broader permissions than necessary, underlining the need for companies to advocate for stringent default settings within these advanced platforms.

The Inherent Conflict of Agent Autonomy and Security

The juxtaposition of agent autonomy and security poses a significant dilemma for enterprises. As identified by Zenity's CTO Michael Bargury, ensuring robust isolation for agents while maintaining their operational connectivity presents conflicting requirements. Organizations must carefully strategize how to balance autonomy with necessary security controls in their environments.

Furthermore, AWS's response to concerns raised by cybersecurity experts emphasized a critical aspect of security awareness; agents indeed do what they are programmed to do. This highlights the need for organizations to meticulously govern how agent privileges are configured and managed. A default agent enabled with extensive permissions could easily become a threat vector across the entire AWS infrastructure.

Lessons from Security Breaches

The ongoing challenges within AWS serve as a notable reminder of how legacy configuration mistakes manifest within advanced platforms. Notably, the SSRF vulnerability allows agents to exploit misconfigurations to access sensitive data, often mirroring incidents from past breaches in different environments. As such, organizations should not only focus on agent functionality but keep a vigilant watch on the security policies governing their deployments.

As enterprise leaders contemplate their security postures, the critical matter becomes less about whether individual agents malfunction and more about ensuring they operate on principles that prioritize security across all potential access points. This requires creating a holistic security model that proposes least-privilege access as a standard practice while also treating agent capabilities with significant caution.

Strategic Recommendations for CISOs and CIOs

Current findings impose a responsibility on CISOs and CIOs to reassess their security frameworks in light of these exposure revelations. The key questions that need addressing include: What identity does an agent operate under? What resources are accessible to it? And, crucially, what happens if it gets compromised? Focusing on answer paths to these queries can lead to more resilient defenses.

In conclusion, as AWS continues to tackle the challenges associated with autonomous agents, organizations need to be proactive in defining stringent parameters around agent behavior. The security landscape for such AI-driven tools remains intricate and demands forward-thinking measures, coupling operational practicality with stringent oversight.