A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity
Summary
Researchers found that AWS AgentCore Harness, a managed runtime for AI agents (software that can reason and take actions), has a security flaw where attackers can use prompt injection (tricking an AI by hiding instructions in its input) to steal plaintext credentials from the identity vault (secure storage for passwords and keys). The problem occurs because the harness's built-in shell tool, which is enabled by default and runs with root access (highest-level permissions), can access the same memory where credentials are temporarily exposed when retrieved from the vault.
Solution / Mitigation
AWS recommends a layered defense approach for operators: (1) "Scope the allowedTools the harness can use to what it needs"; (2) "Scope Identity vault service accounts to least privilege for the downstream integration"; and (3) "Watch outbound traffic from your harness containers."
Classification
Affected Vendors
Related Issues
Original source: https://unit42.paloaltonetworks.com/securing-aws-agentcore-harness-credentials/
First tracked: September 18, 2026 at 08:01 AM
Classified by LLM (prompt v3) · confidence: 92%