Glossary

What are ambient credentials?

Ambient credentials are credentials any code can pick up just by running in a place, such as the cloud metadata service, environment variables or another process's memory, and AI agents that run code inherit them.

Angela Milash

— 1 min read
Share

Ambient credentials are credentials any code can pick up just by running in a place, such as the cloud metadata service, environment variables or another process's memory, and AI agents that run code inherit them.

Why it matters

Agent tools that execute code or make web requests run with whatever the host can reach. If an injected instruction steers the agent, it can read those credentials too, and a shared or over-broad role turns one compromised agent into access across many systems.

Example

On 8 October 2026 Zenity Labs showed one prompt making an AWS AgentCore agent fetch its host's credentials from the instance metadata service; the default role reached every agent in the account and region (Zenity). Unit 42 separately read an AgentCore harness's MCP token from process memory (Unit 42, 18 Sep 2026).

How to defend against it

  • Require IMDSv2 and block metadata addresses from agent tools (checklist).
  • Give each agent its own least-privilege identity.
  • Inject credentials at a broker or proxy outside the sandbox, so the agent never holds the secret.
  • Keep secrets out of environment variables in agent runtimes.

Protocol pivoting, credential broker, non-human identity.

Sources

From AgentSec Brief, the daily brief on securing agentic AI. Subscribe free at https://www.agentsecbrief.com

Read more