Tools AI Risk Radar ai-incident-0137
Incident record
Injected tickets exposed credentials in an AgentCore demonstration
- Severity
- High
- Status
- Proof-of-concept
- Type
- Prompt Injection
- Target
- An AWS AgentCore deployment with shell access and service-account credentials
- Actor
- researcher
What happened
Unit 42 demonstrated how instructions hidden in a support ticket could make an agent use its enabled shell to read credentials from process memory. Those credentials then gave the researcher access to a downstream MCP service.
The demonstration depended on the deployment’s tools and configured service account. AWS assessed the report as informative on 10 June. The practical boundary is which commands an agent can run and which credentials its process can read.
Sources
- Unit 42 researchunit42.paloaltonetworks.com/securing-aws-agentcore-harness-c…
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026