AgentSec Brief N005: AgentCore agents grabbed their runtime's credentials

N005 · Friday 9 October 2026 · 5-min read · Covers 8-9 Oct, plus September catch-ups

Jump to: Incidents · Agent threats & vulnerabilities · Policy, protocols & compliance · Architecture & harnesses · Models & infrastructure · Autonomy, swarms & robotics · Alignment & safety · Defenses, tools & GitHub · Pro deep dives

Today in 30 seconds

• One prompt made a public AWS AgentCore agent fetch its host's credentials from the instance metadata service, and the default role could reach every agent in the account and region.
• Unit 42 showed AgentCore's default shell tool runs as root beside the harness, so an injected ticket read the harness's MCP token from process memory; AWS says scoping it is the customer's job.
• Claude Code 2.1.295 lets guard hooks fail closed, and Copilot's local sandbox is now generally available with admin-enforced policy.

Top story

One prompt let an AgentCore agent take its host's credentials and reach every other agent

8 Oct 2026 · Zenity Labs · "AgentCorruption" · no CVE

A customer-facing AI agent on Amazon's AgentCore could be talked into handing an attacker the keys to every other agent in the same AWS account. Zenity told a public agent with an outbound-request tool to query the instance metadata service (IMDS); the credentials returned belonged to a default execution role that could invoke other agents, read their conversations and memories, pull container images and read Secrets Manager. Poisoned memories gave persistence. AWS has since made IMDSv2 the default and cut the default role's permissions.

For leaders: Ask which identity each production agent runs as, and whether one compromised agent can reach another's data or secrets.

For builders: Give every AgentCore agent its own least-privilege execution role, require IMDSv2, and block metadata access from agent tools.

Pro deep dive ↓

Incidents

Update: Korean bank attacker's exposed logs show Claude Code driving the ARTEX agent

7-8 Oct 2026 · CrowdStrike · Incident · Relevance 9 · first in N002

The Korean bank hacker left their AI attack setup on an open server. CrowdStrike found Claude Code histories, a pentest prompt in CLAUDE.md and ARTEX running on DeepSeek; entry came through a broker loan portal and a staff mobile app.

What it means for US companies: the toolkit is off the shelf and partner portals were the door.

Do this: Hunt CrowdStrike's IOC IPs in partner-portal logs.

Pro deep dive ↓

Agent threats & vulnerabilities

AgentCore's default shell runs as root, so an injected ticket can read the harness's MCP token

18 Sep 2026 (catch-up) · Unit 42 · no CVE · Relevance 8

A hidden instruction in a support ticket got an Amazon-hosted agent to steal the token its own runtime held. The shell shares the harness's root user, so it read /proc/1/mem and replayed the operator's MCP JWT to pull customer data.

Do this: Set allowedTools per session to drop the shell.

Pro deep dive ↓

Also:

• Azure SRE Agent CVE-2026-69435 (CVSS 9.6): missing authorization lets a low-privileged user escalate; check MSRC.

Policy, protocols & compliance

UK ICO asks for evidence on agentic AI before writing a statutory code

8 Oct 2026 · ICO · Consultation open · UK · Closes 20 Nov · Relevance 10

Britain's data regulator wants to know how AI agents handle personal data. Questions cover security, transparency, accountability and automated decisions.

What it means for US companies: UK GDPR reaches any firm whose agents process UK residents' data.

Do this: Map agents touching UK data.

Meta and Sierra propose OAuth sessions for personal agents on business sites

6 Oct 2026 · Sierra · Proposed · v0.1 due late Oct · Relevance 8

The Personal Agent Protocol lets a person's AI agent sign in and act on a company's site. Customers pick read or write access; scopes and revocation aren't specified yet.

Do this: Test revocation before allowing writes.

Pro deep dive ↓

Chart of the day

Architecture & harnesses

Claude Code 2.1.295 lets guard hooks fail closed

8 Oct 2026 · Claude Code release · no CVE · Relevance 9

Safety checks around Anthropic's coding agent used to wave actions through when the check itself crashed. New onFailure: "block" stops that, and guards no longer get silently truncated input.

Do this: Upgrade and set it on every deny hook.

Pro deep dive ↓

Also:

• Copilot local sandboxing is GA: admins can enforce file, network and credential limits.

Models & infrastructure

Also:

• Google previews persistent Gemini agents with their own Workspace accounts (Capability shift): plan agent offboarding.

Autonomy, swarms & robotics

Anthropic bans arming drones with Claude

8 Oct 2026 · Anthropic · Effective 12 Nov · Relevance 7

Claude can't be used to arm drones, and a person must be able to stop any machine it controls.

Do this: Name who can halt Claude-driven hardware.

Alignment & safety

Anthropic: attackers ran agent swarms and stolen AI keys

10 Sep 2026 (catch-up) · Anthropic · Threat report · Relevance 9

Hackers ran fleets of AI agents that split up attacks and rewrote malware until it went undetected, some on victims' stolen AI keys.

Do this: Alert on AI-key usage spikes.

Pro deep dive ↓

Defenses, tools & GitHub

Also:

• PyCache Trap: swapped .pyc files in agent skills beat 7 scanners; strip bytecode when vetting.

One concept

Ambient credentials

Credentials any code can pick up just by running somewhere: the metadata service, environment variables or another process's memory. Agent tools inherit them all.

Basic mitigation: Block metadata from sandboxes and inject secrets at an outside proxy.

Full glossary

AgentSec Brief is published by AM Technology Solutions. Researched and drafted with AI agents, verified against primary sources, and reviewed before publication. Informational only; not legal, compliance or security advice. Verify before acting.

Pro members get the full deep dives with attack diagrams, detection queries and the fix in order, plus the vulnerability tracker, compliance calendar, open-source picks and watch list. Upgrade at https://www.agentsecbrief.com/#/portal/signup