{"data":{"id":"f5069b43-8625-46f0-917d-b0af815df101","title":"A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity","summary":"Unit 42 researchers report that default configurations in AWS AgentCore Harness could let an attacker steer an agent through prompt injection to exfiltrate plaintext credentials managed by AgentCore Identity. The harness's built-in shell tool, enabled by default, reaches the memory space where credentials are resolved to plaintext. AWS reviewed the disclosure and closed it as informative under the AgentCore shared responsibility model.","solution":"For operators building on AgentCore today, defense takes a layered approach: Scope the allowedTools the harness can use to what it needs. Scope Identity vault service accounts to least privilege for the downstream integration. Watch outbound traffic from your harness containers.","labels":["security","industry"],"sourceUrl":"https://unit42.paloaltonetworks.com/securing-aws-agentcore-harness-credentials/","publishedAt":"2026-09-18T10:00:36.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["prompt_injection","data_extraction"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Amazon"],"affectedVendorsRaw":["AWS AgentCore Harness","AWS AgentCore Identity","Model Context Protocol (MCP)"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-09-18T10:00:36.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0051"]}}