**Exploiting AI Agent Infrastructure: How Indirect Prompts Can Reveal Cloud Credentials**
As organizations increasingly deploy autonomous AI agents to handle complex workflows, the attack surface of these systems has expanded dramatically. A recent security discovery highlights how hidden instructions embedded in external data can manipulate an AI agent into executing system-level commands, ultimately exposing sensitive authentication tokens.
The vulnerability centers on cloud-based agent infrastructure that provides built-in tools for interacting with external services. Specifically, researchers explored how an indirect prompt-injection attack could bypass the intended security boundaries of an agent runtime environment.
**The Mechanics of the Attack**
The exploitation begins with an AI agent configured to process external data and interact with a Model Context Protocol (MCP) server. The MCP service requires authentication, with credentials securely managed by a dedicated identity layer within the cloud platform. These credentials remain encrypted and isolated from the agent’s core application code, referenced only by an internal resource identifier.
However, the agent’s environment also includes a built-in shell tool capable of executing operating system commands. When a malicious external source—such as a tampered support ticket—feeds hidden instructions into the agent, the AI may be tricked into activating this shell.
Once the shell is invoked, it operates with the highest system privileges, allowing it to read the memory of the underlying runtime process. During execution, the agent authenticates with the external MCP server, resolving the protected credential into a usable form: a plaintext JSON Web Token (JWT). Because the shell shares the same user context as the runtime, it can easily scan this memory and extract both the token and the server address. The attacker can then route this data out of the environment to an external endpoint, effectively hijacking the agent’s connection to the downstream service.
**The Impact and Scope**
The successful extraction of the JWT allowed the attacker to interact with the MCP server independently, without needing the original user’s AWS credentials. In practical terms, this meant accessing tools provided by the MCP server, such as a customer lookup function containing sensitive personally identifiable information.
Crucially, the attack did not require breaking out of the isolated execution environment. The microVMs hosting the agent provide dedicated compute, memory, and filesystem resources. However, the attack operated entirely within the authorized session, exploiting the fact that the shell and the agent runtime share the same operating system user identifier. The attacker leveraged the legitimate permissions of the Harness session to achieve their objectives.
**The Shared Responsibility Model**
This incident underscores the critical division of security duties in cloud computing. The infrastructure provider is responsible for foundational security elements: microVM isolation, operating system patching, network architecture, and the managed runtime code itself.
Conversely, the customer bears the responsibility for configuring the agent’s behavior and access controls. This includes setting IAM policies, restricting which tools are available to the agent, validating incoming data, and managing network egress. If a developer leaves the shell tool enabled and fails to sanitize incoming messages, they create the conditions for this type of exploitation.
To mitigate these risks, organizations are advised to deploy agents in virtual private cloud (VPC) mode rather than using default public network settings. VPC mode enforces strict network boundaries, allowing administrators to use security groups and access control lists to limit which external endpoints the agent can reach. Additionally, applying the principle of least privilege to the service accounts used by the agent ensures that even if a token is compromised, the blast radius is limited.
**FAQ**
**Q: What is an indirect prompt-injection attack?**
A: This occurs when an attacker embeds malicious instructions inside external data that an AI agent consumes. When the agent processes the data, the hidden instructions override its intended behavior, tricking it into taking unauthorized actions.
**Q: Why was the JWT accessible in the runtime memory?**
A: When an agent uses an identity service to access an external resource, it must resolve the stored credential into a usable token for that session. While the credential is safely stored and encrypted, the resolved token temporarily exists in plaintext within the runtime’s active memory, making it vulnerable to extraction if the runtime environment is compromised.
**Q: Does the isolated microVM environment protect against this type of attack?**
A: The microVM prevents unauthorized access between different agent sessions. However, it does not prevent an actor operating *within* the same authorized session from accessing the runtime’s memory and local tools. The isolation boundary is between sessions, not necessarily between the agent’s tools and its own runtime memory.
**Q: What can customers do to prevent such attacks?**
A: Customers should restrict the built-in tools available to agents (such as disabling shell access unless absolutely necessary), enforce least-privilege permissions on agent service accounts, deploy agent runtimes in VPC mode to control outbound traffic, and validate or sanitize all incoming data before the agent processes it.
**Conclusion**
The integration of AI agents into cloud ecosystems offers immense operational efficiency but introduces complex security challenges. As agents gain the ability to execute code, access memory, and interact with external services, the line between the agent’s intent and an attacker’s manipulation becomes dangerously thin. Securing these environments requires more than just infrastructure isolation; it demands rigorous input validation, strict tool scoping, and a clear understanding of the shared responsibility model. Organizations must assume that any tool provided to an agent, including shell access, can be weaponized through hidden prompts if proper safeguards are not strictly enforced.
Thank you for reading
