Cloud Security

There Is No Safe Starter Kit. There Is Only One Nobody Has Tested Yet.

May 7, 2026 No comments yet

This piece is my read on research published by Unit 42 at Palo Alto Networks. The findings are theirs; the argument about what they mean is mine. Their original write-up is worth reading in full.

Everybody is rushing to deploy AI agents in production.

Amazon released a starter kit for AgentCore, their new platform for building agents. Convenient. Fast. Ready to use. Exactly what every development team likes to hear.

That kit arrives with IAM roles created automatically – with wildcard permissions on every resource.

Which means every agent in your account can:

  • read the memory of every other agent
  • reach any container registry
  • download proprietary source code
  • use interpreters with higher privileges
  • and move laterally across your entire environment

Unit 42’s researchers called it “Agent God Mode”. The name is accurate.

And what did AWS do in response to the findings?

Updated the documentation with a clarification that the defaults are intended “for development and testing only”.

That is the fix. Documentation.

I am sure every attacker who reads that clarification will immediately change their approach.

The real problem is not AWS specifically

The real problem is that the culture of “deploy fast, fix later” has moved from web applications to AI agents. With one small difference people do not appreciate.

When a web app is misconfigured, an attacker might reach certain data. When an AI agent runs with god-mode permissions, it can move laterally across the entire environment. Steal conversations from other agents. Extract proprietary code from the container registry. Escalate privileges through code interpreters. Without leaving many traces.

We see this at clients constantly. Not because they are foolish, but because the tools arrive with default settings that look ready to use. And they are not always.

If you are deploying AI agents in production

Ask exactly what each agent is permitted to do. Open the IAM configuration. Check whether there is a wildcard.

Least privilege applies to code written by AI as well. And to tools that come ready out of the box. And to starter kits that look innocent.

There is no safe starter kit for production. There is only a starter kit that has not been tested yet.

I first shared a version of this as a LinkedIn post on 2026-05-07. It is republished here, lightly edited, so it is easier to find and reference. — Erez Metula