A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity

Summary

Unit 42 researchers report that default configurations in AWS AgentCore Harness could let an attacker steer an agent through prompt injection to exfiltrate plaintext credentials managed by AgentCore Identity. The harness's built-in shell tool, enabled by default, reaches the memory space where credentials are resolved to plaintext. AWS reviewed the disclosure and closed it as informative under the AgentCore shared responsibility model.

Mitigation

For operators building on AgentCore today, defense takes a layered approach: Scope the allowedTools the harness can use to what it needs. Scope Identity vault service accounts to least privilege for the downstream integration. Watch outbound traffic from your harness containers.

Related items

• InfoUnited Airlines blocks AI agents from booking flights, citing cybersecurity risksSame vendor · TechCrunch (Security)
• InfoStraiker EU & India Expansion | Regional AWS HostingSame vendor · Straiker Blog
• InfoJim Cramer: This is the bet you're making if you buy the Anthropic IPOSame vendor · CNBC Technology
• MediumAntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production SecretsSame vendor · The Hacker News
• InfoAnthropic's IPO roadshow videoSame vendor · Simon Willison's Weblog