Recent research from Unit 42 has uncovered a significant vulnerability in Amazon Web Services (AWS) AgentCore Harness, which could allow attackers to exfiltrate plaintext credentials through prompt injection. This issue arises from the default configurations of the harness, particularly its built-in shell tool, which can be manipulated to access sensitive information managed by the AgentCore Identity vault.
The investigation focused on two key integrations within the harness: the AWS AgentCore Identity, which serves as the recommended method for managing agent identities and storing credentials, and a downstream Model Context Protocol (MCP) server that the harness authenticates against using credentials from the identity vault. While AWS AgentCore Identity employs encryption at rest and in transit, as well as key management service (KMS) keys and identity and access management (IAM) controls, the research revealed a critical flaw at runtime. The shell tool, enabled by default, accesses the same memory space where credentials are resolved into plaintext, creating a potential attack vector.
Upon disclosing these findings to AWS, the company responded by closing the report as informative under the AgentCore shared responsibility model, emphasizing that controls such as allowedTools scoping and egress filtering are the responsibility of the customer.
Understanding the Vulnerability
The AWS AgentCore Harness is designed to facilitate the operation of AI agents by managing various aspects such as environment, compute, memory, identity, and networking. However, the default settings, particularly the inclusion of the shell tool, pose a significant risk. This tool runs with root access, meaning that any command executed by an attacker inherits this level of privilege, allowing for arbitrary shell commands and file operations.
To illustrate the potential for exploitation, researchers created a fictional scenario involving a customer-support agent operating on the AgentCore Harness. By manipulating the harness’s configuration, they were able to execute commands that led to the exfiltration of sensitive information, including JSON Web Tokens (JWTs) and URLs for downstream services. This was achieved through indirect prompt injection, where the agent was instructed to execute a command that fetched and executed a malicious script.
Exfiltration Process
The exfiltration process involved several steps. First, the researchers crafted a script designed to scan the harness’s memory for specific patterns indicative of JWTs and MCP server URLs. Once the script was executed within the harness, it successfully retrieved a JWT and the corresponding MCP URL, which were then sent to an external webhook controlled by the researchers. This demonstrated that even with the identity vault’s protections, the credentials could be accessed and exploited due to the shell tool’s capabilities.
Upon decoding the exfiltrated JWT, it was revealed that the token belonged to the operator’s service account, not an end-user. This highlights a critical distinction: while end-user session tokens are transient and tied to individual users, the credentials stored in the AgentCore Identity vault are stable and intended for long-term use by the harness itself.
Recommendations for Mitigation
To mitigate the risks associated with this vulnerability, organizations utilizing AWS AgentCore Harness should adopt a layered defense strategy:
- Scope the allowedTools parameter to limit the tools available to each session, ensuring that unnecessary capabilities are disabled.
- Implement least privilege access for identity vault service accounts to minimize the potential impact of credential exposure.
- Monitor outbound traffic from harness containers to detect any unauthorized communications that may indicate an active injection attempt.
As AI agents become increasingly capable and autonomous, the attack surface associated with their operational environments expands. This research underscores the importance of securing not just the credentials at rest and in transit, but also those in use, particularly in managed runtimes like AWS AgentCore Harness.
For further details on this vulnerability and its implications, refer to the comprehensive analysis by Unit 42 here.
Follow Cyber Warriors Middle East for further cybersecurity features, analysis and insights.
