Palo Alto Networks’ Unit 42 found that AI agents on AWS’s AgentCore platform can leak sensitive credentials to attackers despite an encrypted vault. Researchers demonstrated a prompt-injection attack in which a malicious support ticket made an AI agent run code and send a token to a test attacker. AWS reviewed and closed the report as informative, arguing customers must limit what agents can use and access, because default settings can leak secrets. AgentCore Harness includes a built-in shell tool by default, and when an agent needs a credential, the secret is temporarily decrypted and stored in memory in plain text; the shell tool can access the same memory region, with the agent running as root with complete unrestricted access. Researchers recommend disabling unneeded tools, limiting each key’s permissions, and monitoring outbound traffic.