> ## Content Index
> Fetch the complete content index at: https://www.agentsecbrief.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# What are ambient credentials?
- URL: https://www.agentsecbrief.com/what-are-ambient-credentials/
- Published: 2026-10-09T18:11:00.000Z
- Updated: 2026-10-09T18:11:00.000Z
- Description: Ambient credentials are credentials any code can pick up just by running in a place, such as the cloud metadata service, environment variables or another process's memory, and AI agents that run code inherit them.
- Author: Angela Milash
- Tags: Glossary, Agent Identity & Auth, Sandboxing & Runtime

**Ambient credentials are credentials any code can pick up just by running in a place, such as the cloud metadata service, environment variables or another process's memory, and AI agents that run code inherit them.**

## Why it matters

Agent tools that execute code or make web requests run with whatever the host can reach. If an injected instruction steers the agent, it can read those credentials too, and a shared or over-broad role turns one compromised agent into access across many systems.

## Example

On 8 October 2026 Zenity Labs showed one prompt making an AWS AgentCore agent fetch its host's credentials from the instance metadata service; the default role reached every agent in the account and region ([Zenity](https://zenity.io/press-release/zenity-labs-discloses-agentcorruption-a-chain-of-aws-agentcore-flaws?ref=agentsecbrief.com)). Unit 42 separately read an AgentCore harness's MCP token from process memory ([Unit 42, 18 Sep 2026](https://unit42.paloaltonetworks.com/securing-aws-agentcore-harness-credentials/?ref=agentsecbrief.com)).

## How to defend against it

- Require IMDSv2 and block metadata addresses from agent tools ([checklist](https://www.agentsecbrief.com/checklist/)).
- Give each agent its own least-privilege identity.
- Inject credentials at a broker or proxy outside the sandbox, so the agent never holds the secret.
- Keep secrets out of environment variables in agent runtimes.

## Related terms

[Protocol pivoting](https://www.agentsecbrief.com/what-is-protocol-pivoting/), credential broker, non-human identity.

## Sources

- [Zenity Labs, AgentCorruption (8 Oct 2026)](https://zenity.io/press-release/zenity-labs-discloses-agentcorruption-a-chain-of-aws-agentcore-flaws?ref=agentsecbrief.com)
- [Unit 42 (18 Sep 2026)](https://unit42.paloaltonetworks.com/securing-aws-agentcore-harness-credentials/?ref=agentsecbrief.com)
- [AWS, configuring the instance metadata service](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html?ref=agentsecbrief.com)

From AgentSec Brief, the daily brief on securing agentic AI. Subscribe free at [https://www.agentsecbrief.com](https://www.agentsecbrief.com/)