Unit 42 researchers found that using default configurations in AWS AgentCore Harness can let an attacker steer an agent's actions through prompt injection into exfiltrating plaintext credentials managed by AgentCore Identity. The finding came from examining two of the harness's integrations: AgentCore Identity, AWS's recommended identity vault for agent credentials, and a downstream MCP server that the harness authenticates against using a credential from that vault. AgentCore Identity provides encryption at rest and in transit, KMS keys and IAM-gated access — but the researchers asked what happens at runtime, when a credential has to leave the vault to be used, and found that the harness's own built-in shell tool, enabled by default, reaches into the same memory space where credentials are resolved to plaintext. Unit 42 disclosed the issue to AWS, which reviewed and closed the report as informative under the AgentCore shared responsibility model, citing allowedTools scoping and egress filtering as customer-side controls. The practical mitigation is layered: scope the tools the harness may use to what it needs, grant the identity vault's service accounts least privilege for the downstream integration, and watch outbound traffic from harness containers.

• Source article