A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity
Unit 42 found AWS AgentCore's default shell tool lets prompt injection reach plaintext AgentCore Identity credentials; AWS closed the report as informative.
Unit 42 found that AWS AgentCore Harness's default-enabled shell tool runs as root and shares the memory space where AgentCore Identity vault credentials resolve to plaintext, so prompt injection could steer an agent to exfiltrate credentials used for downstream MCP integrations. AWS closed the disclosure as informative under the AgentCore shared responsibility model, citing customer-side controls. Recommended defenses include scoping allowedTools, least-privilege vault service accounts, and monitoring outbound traffic from harness containers.
- Default-enabled shell tool runs as root inside AgentCore Harness sessions
- Vault credentials resolve to plaintext in shared memory reachable by the shell
- Prompt injection can steer agents to exfiltrate downstream integration credentials
- AWS closed the report as informative, citing allowedTools scoping and egress filtering
- Mitigations: scope allowedTools, least-privilege vault accounts, monitor egress
- Products
- AWS AgentCoreAgentCore Identity
- Organizations
- Unit 42
From the original article
14 min read at unit42.paloaltonetworks.com
Analysis of how default configurations in AWS AgentCore Harness allow prompt injection to exfiltrate credentials, and key steps to secure your agents. The post A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity appeared first on Unit 42.
By Niv Rabin · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.