-
AWS Bedrock AgentCore Runtime Prompt Containing Credentials
Oct 1, 2026 · Domain: Cloud Data Source: AWS Data Source: Amazon Web Services Data Source: AWS Bedrock Data Source: Amazon Bedrock Use Case: Threat Detection Tactic: Credential Access Resources: Investigation Guide Noise: Low Performance: Fast Profile: Recommended Threat: Unauthorized AI Usage Threat: LLMjacking Rule Type: ES|QL Platform: AWS Domain: GenAI Service: AWS Bedrock Mitre Atlas: AML.T0055 Mitre Atlas: AML.T0057 ·Identifies prompts sent to an Amazon Bedrock AgentCore runtime that contain AWS access key identifiers (AKIA long-term or ASIA temporary/STS), Amazon Bedrock API keys (ABSK bearer tokens), or PEM-encoded private keys. The runtime application logs record the caller-supplied prompt; credentials embedded in a prompt are exposed to the model provider, persisted in observability logs, and may be returned in completions or used by downstream tools. This commonly indicates accidental secret leakage by a user or application, or an attempt to stage credentials for misuse through the agent. Secrets should never be passed to an agent in clear text.
Read More -
AWS Bedrock AgentCore Runtime Prompt Targeting Credentials or Instance Metadata
Oct 1, 2026 · Domain: Cloud Data Source: AWS Data Source: Amazon Web Services Data Source: AWS Bedrock Data Source: Amazon Bedrock Use Case: Threat Detection Tactic: Credential Access Resources: Investigation Guide Noise: Low Performance: Normal Profile: Recommended Threat: Unauthorized AI Usage Threat: LLMjacking Threat: IMDS Credential Theft Rule Type: ES|QL Platform: AWS Domain: GenAI Service: AWS Bedrock Mitre Atlas: AML.T0054 Mitre Atlas: AML.T0098 ·Identifies prompts sent to an Amazon Bedrock AgentCore runtime that attempt to harvest credentials or coerce the agent into exfiltrating data. The runtime application logs capture the caller-supplied prompt; this rule flags prompts that reference the cloud instance metadata service (169.254.169.254, the ECS task metadata address, or the "latest/meta-data" / "security-credentials" paths), prompts that name AWS access or secret keys directly, and prompt-injection or jailbreak language ("ignore previous instructions", "developer mode", "do anything now") combined with intent to reveal secrets, system prompts, or send data to an external endpoint. Asking an agent to read instance metadata credentials or to exfiltrate secrets is rarely legitimate and indicates an attempt to weaponize the agent for credential theft, even when the model refuses the request.
Read More