A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity
Source Palo Alto Unit 42
Description
Unit 42 researchers identified that AWS AgentCore Harness's default configuration enables a built-in shell tool with root privileges, which can be exploited via prompt injection to exfiltrate plaintext credentials from the AgentCore Identity vault. The shell tool is enabled by default and can execute arbitrary shell commands with root access, posing a risk if allowedTools is not scoped properly. AWS reviewed the finding and classified it as informative under the shared responsibility model, emphasizing customer-side controls such as scoping allowedTools and egress filtering. Mitigation involves restricting allowedTools to only necessary tools, applying least privilege to identity vault service accounts, and monitoring outbound traffic from harness containers. No official patch or fix is indicated; remediation relies on configuration and operational controls.