On LinkedIn
Someone filed a support ticket and got live AWS credentials back. No exploit. No CVE. They wrote the request down and let the agent read it.
Unit 42 demonstrated this on AWS AgentCore. The vault was there, doing exactly what vaults do. Then the agent, running as root in the same process, was talked into reading the memory where that credential sat decrypted and posting it to a webhook. The protection never failed. The agent simply looked around it.
AWS closed the report as “informative”.
That kills the first instinct, which is a better harness. The harness was standing right next to the credential when it walked out the door.
The second instinct is to train the agent. We have been training humans for thirty years. Phishing still lands, because it comes down to timing, urgency and luck, and nobody wins that lottery every single day. Gut feeling is not a control. It is just better than nothing, and an agent does not even have that. It reads everything, never gets tired, never asks a colleague whether this seems off, and it is holding root.
Nobody I talk to believes agents are as smart as people. They believe agents will read the things nobody else has the stomach for. That is why the access keeps growing: every dull job we hand over comes with one more key.
Guardrails ask. Vaults ask. A better system prompt asks. None of that is control.
You cannot train it. So limit it. Nothing that ticket asked for required a credential vault, and nothing stopped the agent from reaching one. Segmentation is not one of the options. It is the one that is left.
How much can your agent reach if someone talks it into something this afternoon? Do you know, or are you assuming?
The research: Unit 42 on securing AWS AgentCore harness credentials.