Opening SecureFlowAgentCore Starter-Toolkit IAM Exposes Other Agents' Memory
Case summary & sources

AIDEFEND SecureFlow / SecureFlow Case Index

Palo Alto Networks Unit 42 aidefend-sf0053

AgentCore Starter-Toolkit IAM Exposes Other Agents' Memory

  • Autonomous Agents
  • Data Exfiltration
  • Data Corruption

Unit 42 demonstrated that starter-toolkit-created AgentCore execution roles used broad resource wildcards for ECR, AgentCore Memory, runtime, and Code Interpreter actions. After an initial agent is compromised, its role can pull another agent's image, recover a MemoryID from the image, and read that agent's memory records; Unit 42 states the same permission shape would also allow poisoning, which the test did not demonstrate. AWS clarified that generated roles are for development and testing, not production.

Mapped threat techniques

  • AML.T0080.000 Memory
  • AML.T0010.001 AI Software

Source

Updated