TL;DR: One prompt to an exposed Amazon Bedrock AgentCore agent could expose metadata service credentials and let an attacker take over every agent in the same AWS account and region, according to Adversa AI, while embedded browser agents and tool-risk gates also proved easier to steer than expected. Runtime trust assumptions fail when agents can read, act, and delegate beyond the boundaries defenders think they set.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Adversa AI's research: Exposed agent runtimes can expose metadata credentials, enable cross-agent takeover, and bypass browser and tool-gating assumptions.
Why it matters: IAM, PAM, and NHI teams need to govern agent-issued access, runtime delegation, and outbound tool use as one control surface rather than separate problems.
Context
Adversa AI's findings point to a governance assumption many programmes still make: that an agent's prompt stays inside a bounded trust envelope. Once the runtime can reach cloud metadata, embedded browsers, or delegated tools, that assumption breaks and the security boundary shifts from content to execution.
For identity teams, the issue is not simply prompt injection. It is the fact that agent identities can inherit credential scope, tool access, and network reach that were never designed for independent runtime decisions, which makes agent identity governance the missing control layer.
Key questions
Q: How do exposed AI agents reach cloud metadata services?
A: Exposed AI agents reach cloud metadata services by running with network access and a workload identity that can call local instance or container metadata endpoints for temporary credentials. If the agent can fetch those credentials, it may assume the attached role and access cloud resources beyond its intended scope. Block metadata access, isolate the agent, and bind credentials to least-privilege roles.
Q: Why do embedded browsers increase agent risk?
A: Embedded browsers increase agent risk because they let an AI agent execute web actions, follow links, and interact with sessions in the same runtime that holds its tool permissions and secrets. That creates a larger attack surface for prompt injection, session hijacking, and credential theft. Separate browsing from privileged tools, strip secrets from the browser context, and require approval for sensitive actions.
Q: What is the best way to limit tool misuse in AI agents?
A: The best way to limit tool misuse in AI agents is to enforce capability boundaries. Give each tool a narrowly scoped permission set, validate every call against policy, and require explicit approval for high-impact actions such as sending data, changing records, or triggering payments. Pair that with short-lived credentials and revocation controls.
Q: How should teams contain AI agent identity risk before a compromise spreads?
A: Teams should narrow task scope, shorten token lifetime, and separate high-trust actions from low-trust prompts so a single compromised agent cannot move freely across tools. The goal is to reduce identity blast radius before the agent touches sensitive workflows. Containment should be designed around action boundaries, not just around authentication events.
Technical breakdown
How metadata service access becomes agent takeover
Cloud instance metadata services issue short-lived credentials to workloads, but they are reachable from inside the runtime unless explicitly blocked. When an agent can make HTTP requests, SSRF-style access to metadata can expose role credentials, session tokens, or adjacent secrets. In an agent platform, that turns a single prompt into a path from content manipulation to authenticated cloud action. The problem is not just credential exposure. It is that the agent's execution context already contains the trust needed to fetch and reuse those credentials. See the Amazon Bedrock Security Guide.
Practical implication: Treat metadata endpoints as hostile to any agent that can issue arbitrary network requests, and remove that reach at the platform boundary.
Why embedded browsers expand the trust boundary
An embedded browser inside an AI agent is not a normal browser session. It can inherit host-level permissions, read local files, access authenticated web sessions, and follow page-driven instructions that the user never intended to delegate. That collapses the separation between web content and workstation control. The browser is no longer just rendering content; it becomes a tool with ambient authority over the host and the user's context. Browser rules that assume a human operator are too weak for that model. See the Browser and Computer-Use Agent Security Guide.
Practical implication: Constrain embedded browsers to isolated sandboxes with explicit site scope and no inherited host authority.
Why tool-risk gating fails when the model sees the policy
Tool-risk gating works only when the classifier evaluates untrusted actions, not attacker-crafted policy text. If a counterfeit policy or manipulated context can influence the scoring model, the gate is judging a contaminated input stream rather than the actual request. That means the control is vulnerable to prompt injection in the decision layer itself. A structured output does not fix that if the upstream reasoning still comes from untrusted content.
Practical implication: Keep policy evaluation separate from attacker-controlled inputs and verify that deny decisions are based on enforceable controls, not model judgment alone.
Threat narrative
Attacker objective: Gain authenticated control of the agent runtime and use that access to expand into cloud resources, adjacent agents, and sensitive data paths.
- entry via an exposed agent runtime that could reach cloud metadata services and embedded browser functions.
- credential access through metadata service credentials exposed inside the workload execution context.
- escalation as those credentials were reused to reach adjacent agents, cloud settings, and host-level resources.
- impact through takeover of the surrounding agent estate, unauthorized data access, and control of delegated actions.
Breaches seen in the wild
- Langflow Flodrix botnet 2025: Attackers used Langflow's unauthenticated code endpoint to dump AI servers' environment variables and enlist them in the Flodrix botnet.
- Smithery.ai MCP hosting breach 2025: A Smithery.ai build flaw gave GitGuardian a live fly.io token controlling 3,000+ hosted MCP servers and the API keys their clients sent.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Agent runtime trust is collapsing into execution trust. Adversa AI's findings show that the core problem is not whether a prompt is malicious but whether the runtime can turn that prompt into privileged actions. Once metadata access, browser reach, and tool use sit inside the same execution path, prompt control is no longer a sufficient security boundary. Practitioners need to govern the runtime that acts on the prompt, not the text alone.
Metadata service access is an identity issue before it is a cloud issue. A workload identity that can fetch cloud credentials from inside the agent runtime can be repurposed by the agent as soon as the prompt pushes it there. That makes the old assumption that access is static and operator-owned untenable, especially when the same role can affect multiple agents in one account and region. The implication is that agent identity and cloud identity now fail together unless the trust chain is broken at issuance.
Browser delegation now needs the same scrutiny as API delegation. Embedded browsers in agent runtimes inherit more than page rendering capability; they can inherit session state, file access, and host reach. That means the browser is part of the agent's privilege envelope, not a separate user interface. Organisations that still treat browser automation as low-risk are underestimating how quickly a page can become an execution primitive.
Policy gates cannot be trusted if the model can rewrite the story the gate reads. The Jev results are a useful warning because they show that a decision model can be steered by counterfeit policy text and still look like it is enforcing safety. That is a control design problem, not just a model quality issue. If the enforcement layer reads attacker-controlled context, the gate itself becomes an attack surface.
Identity blast radius must be measured at the agent cluster, not the single agent. The most important operational question is no longer whether one agent is compromised but how far the same credential or browser trust can propagate across the estate. That requires governance models that inventory delegation chains, shared tokens, and cross-agent reuse together. The implication is a shift from isolated agent review to estate-level containment.
From our research library:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- Read next: Agentic AI Identity Guide
What this signals
Identity blast radius is moving from the agent to the estate. Governance that reviews a single agent in isolation will miss the shared roles, browser sessions, and delegated tools that actually determine impact. The practical shift is toward estate-level containment models that assume one runtime can affect many others.
Access reviews assume a privilege lasts long enough to be certified. Agents that request and release credentials inside a single workflow leave little durable state to review, so the control question moves to issuance time rather than recertification time.
For practitioners
- Block metadata endpoint reach from agent runtimes Prevent agents from calling instance metadata or equivalent credential endpoints unless the runtime is explicitly designed for that access and the path is isolated from untrusted prompts.
- Isolate embedded browsers from host authority Run browser-capable agents in constrained sandboxes with no inherited workstation permissions, no direct file access, and strict site scope.
- Separate policy evaluation from attacker-controlled input Move tool-risk and approval logic out of the model path so counterfeit policy text cannot influence the control decision.
- Inventory shared credentials across agent estates Map which agents share roles, tokens, browser sessions, or downstream tool access so one compromise cannot silently propagate across the account or region.
- Revoke and reissue tokens on rollback events If an agent changes a token audience, downloads sensitive data, or crosses an authorization boundary, treat configuration rollback and token revocation as separate response steps.
Key takeaways
- Exposed agent runtimes can turn a prompt into privileged cloud and host action when metadata access, browsers, and tools sit inside the same trust boundary.
- The evidence spans credential exposure, cross-agent takeover, browser-driven host access, and policy gating that can be manipulated by attacker-controlled context.
- Practitioners need to move enforcement outside the model and govern the runtime path, shared credentials, and delegated browser authority as one estate-level problem.
Related NHI Mgmt Group resources: Agentic AI Identity Guide · Browser and Computer-Use Agent Security Guide · Amazon Bedrock Security Guide · Spain's first AI agent data breach 2026
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Metadata exposure and reused credentials are central to the takeover pattern described by Adversa AI. |
| Recommendation — Scan agent runtimes for exposed secrets and remove any path that lets the model fetch cloud credentials. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article centres on agents abusing delegated privilege, browser reach, and tool access. |
| Recommendation — Scope agent identities and tool permissions so runtime decisions cannot expand privilege beyond intended boundaries. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The described paths move from credential exposure to expansion across agents and account resources. |
| Recommendation — Map metadata access and shared-agent reuse to credential access and lateral movement in detections. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The issue is over-broad entitlements inside agent runtimes and across delegated browser use. |
| DE.CM-06 — External Service Provider Activities Monitored | Agent traffic across public services and remote browser chains needs explicit monitoring. | |
| Recommendation — Review agent entitlements against actual task scope and remove permissions the runtime does not need. Monitor agent calls into external services and flag relay patterns that move data through public infrastructure. | ||
Key terms
- Agent Identity: An agent identity is the set of attributes, credentials and permissions assigned to an autonomous software entity. It is treated as a non-human identity because it can authenticate, act on systems and accumulate access over time, which creates governance, audit and lifecycle obligations similar to other production identities.
- Metadata Service: A metadata service is a local endpoint that provides runtime details and temporary credentials to cloud workloads. It is convenient for automation, but it becomes a theft path when an attacker can run code inside the workload and retrieve identity material directly.
- Embedded Browser: An embedded browser is a web rendering component inside a mobile app, such as a WebView or Custom Chrome Tab. It keeps the user inside the app experience, but it often changes how cookies, storage, and session state behave compared with a full browser.
- Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on November 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org