Credential-Exfiltration

AWS AgentCore Harness Ships Built-In Shell and Identity Vault Tools

FIRST LOOK ATLAS OWASP HIGH ▲ 7.8 Palo Alto Unit 42 Sep 18, 2026

Unit 42 researchers have published a detailed analysis of AWS AgentCore Harness's default configuration, specifically how its built-in shell tool and AgentCore Identity credential vault interact at runtime when credentials are resolved to plaintext. The research closes a visibility gap for defenders by providing concrete, operationally grounded guidance on scoping allowedTools, applying least-privilege to Identity vault service accounts, and monitoring outbound traffic from harness containers. What remains is an organisational maturity question: operators must actively opt into these controls rather than relying on secure defaults, meaning the benefit is fully realised only by teams with the awareness and tooling to enforce runtime scoping.

GitHub Copilot Autofix Introduced CI/CD Injection in Snowflake

ATLAS OWASP CRITICAL ▲ 9.2 HN AI Security Aug 18, 2026

Wiz Research's autonomous Red Agent discovered and exploited a GitHub Actions script injection vulnerability in a Snowflake public repository, introduced by a GitHub Copilot Autofix co-authored commit just five days prior. The flaw allowed any unauthenticated GitHub user to execute arbitrary commands in a Actions runner by crafting a malicious issue title, ultimately enabling exfiltration of a token granting access to Snowflake's internal Jira instance. The incident exposes a critical trust gap: AI-assisted code review and AI-generated fixes can introduce and simultaneously fail to detect severe security vulnerabilities.

Palo Alto Exposes AI Agent Skill Supply Chain Compromise Risk

ATLAS OWASP HIGH ▲ 8.5 Palo Alto Unit 42 Jun 12, 2026

Palo Alto Unit 42 introduces Behavioral Integrity Verification (BIV), an audit method exposing widespread mismatches between what third-party AI agent skills claim to do and what they actually execute. Applied at registry scale, BIV identifies a dangerous subset of skills carrying multi-stage attack chains capable of credential theft, remote code execution, and silent data exfiltration. The research highlights that the AI agent skill ecosystem has grown rapidly without the supply-chain audit primitives that mobile and browser extension platforms eventually adopted after abuse.

Claude Sandbox Escape Enables Credential Exfiltration

ATLAS OWASP MEDIUM ▲ 7.2 Simon Willison May 31, 2026

Anthropic has published detailed documentation of its sandboxing architecture across Claude.ai, Claude Code, and Claude Cowork, including disclosure of a previously identified credential exfiltration vector via the api.anthropic.com/v1/files endpoint. The writeup covers process-level isolation technologies including gVisor, Seatbelt, Bubblewrap, and full VM approaches, and candidly acknowledges security gaps that were missed. This transparency is notable for the agentic AI space, where sandbox documentation is typically sparse and trust is difficult to calibrate.

CVE-2026-33579: OpenClaw Privilege Escalation to Admin

ATLAS OWASP CRITICAL ▲ 9.2 Ars Technica Security Apr 23, 2026

A critical privilege escalation vulnerability (CVE-2026-33579) in OpenClaw, a viral agentic AI tool, allowed attackers with the lowest-level pairing permissions to silently gain full administrative access to any OpenClaw instance. Given that OpenClaw by design holds broad access to sensitive resources—including credentials, files, and connected services—the practical blast radius of this flaw is full instance takeover with no user interaction required. Thousands of deployments may already be silently compromised.