The AWS AgentCore Harness is a managed runtime for AI agents that includes built-in tools enabled by default, notably a shell tool that executes bash commands as root. Researchers found that this default configuration allows attackers to perform prompt injection attacks that cause the agent to run arbitrary shell commands, accessing plaintext credentials stored in the AgentCore Identity vault. The vault provides encryption and IAM controls, but at runtime, credentials must be resolved to plaintext in memory, which the shell tool can access. AWS reviewed the report and closed it as informative, citing that allowedTools scoping and egress filtering are customer responsibilities under the shared responsibility model. Operators are advised to restrict allowedTools, apply least privilege to service accounts, and monitor outbound traffic to mitigate risks.

If the default configuration is used without restricting allowedTools, an attacker can leverage prompt injection to execute arbitrary shell commands with root privileges inside the AgentCore Harness. This can lead to exfiltration of plaintext credentials managed by the AgentCore Identity vault. The impact includes unauthorized access to sensitive credentials and potential compromise of downstream services authenticated by those credentials. However, AWS considers this a customer-side configuration issue rather than a vulnerability in the service itself.

AWS has not issued a patch or official fix; remediation depends on customer configuration. Operators should scope the allowedTools parameter to only the tools necessary for each session, disabling the default shell tool if not required. Identity vault service accounts should be assigned least privilege access tailored to downstream integrations. Additionally, monitoring and filtering outbound traffic from harness containers can help detect and prevent credential exfiltration. These layered defenses align with AWS's shared responsibility model for AgentCore Harness security.