AWS AgentCore Harness — Identity Credential Exfiltration via Prompt Injection in AI Runtimes (N/A)

Publication date: September 18, 2026
Category: AI attacks (LLM/LocalAI)

Introduction

Researchers at Palo Alto Networks Unit 42 have identified a critical architectural and default-configuration issue in AWS AgentCore Harness, a managed runtime environment designed for AI agents. The vulnerability allows an attacker, utilizing indirect prompt injection techniques, to manipulate an agent’s execution flow, run arbitrary system commands, and exfiltrate corporate credentials stored in plaintext within the runtime’s memory space (PID 1). Although AWS closed the report as informative under the shared responsibility model, the finding highlights the dangerous gap between encrypted storage mechanisms (vaults) and dynamic tool execution at runtime.

What is AWS AgentCore Harness and Memory-in-Use Exposure? (General Analysis)

AWS AgentCore Harness is a managed runtime that simplifies AI agent deployments by handling infrastructure, compute, networking, and integrated tooling. Among its default capabilities, the harness ships with two built-in tools enabled out of the box: shell (executing Bash commands) and file_operations (viewing and editing files).

To integrate with external services, the platform relies on AWS AgentCore Identity, an identity vault that encrypts credentials at rest and in transit using KMS keys. However, for an agent to authenticate against downstream services—such as Model Context Protocol (MCP) servers—the ARN reference stored in the vault must be resolved at runtime into a plaintext token (e.g., a JSON Web Token or JWT) inside the primary process memory (PID 1).

Because the shell tool is enabled by default and executes with root privileges within the exact same process space, an attacker capable of injecting instructions can directly read the memory and harvest active operational credentials.

Technical Note on Vulnerability Identifiers: This incident does not currently have an official CVE identifier assigned. It is conceptually classified as an architectural design weakness and sensitive information exposure in memory, with a reasoned severity estimate of CVSS v3.1: 8.6 (High) and a classification of CWE-316 (Cleartext Storage of Sensitive Information in Memory) / CWE-276 (Incorrect Default Permissions) based on behavioral privilege exposure analysis.

How Does It Work? (Technical Analysis)

The exploitation mechanism does not rely on traditional software bugs; instead, it leverages the natural interaction between language model reasoning, default harness capabilities, and dynamic credential resolution.

  • Initial Entry and Execution Flow: The attacker introduces a hidden malicious instruction (e.g., via an HTML comment inside a support ticket or document processed by the agent). This injection tricks the LLM into invoking the built-in shell tool, executing an external payload like curl script.py | python3.
  • Privilege Escalation & Process Discovery: Once inside the harness container, the reconnaissance script executes commands such as whoami, discovering that both the child shell and the parent process (PID 1, running python3.10 -m loopy.server) operate under the root user. By inspecting the virtual filesystem (procfs), the attacker maps memory via /proc/1/maps and accesses physical process memory through /proc/1/mem.
  • Secret Harvesting and Exfiltration: The custom script traverses readable heap memory regions, searching for byte patterns matching authentication JWTs and downstream MCP server URLs. Once identified, the extracted data is packaged and sent via an HTTP POST request (curl) to an attacker-controlled external webhook, enabling full token replay from the internet without requiring AWS credentials.

Affected Systems / Environments

The issue impacts deployments utilizing default configurations of AWS AgentCore Harness, specifically:

  • AWS AgentCore Harness environments where the allowedTools parameter has not been strictly restricted at session creation or invocation time.
  • Instances maintaining the default-enabled shell and file_operations tools.
  • Applications utilizing downstream integrations via Model Context Protocol (MCP) servers authenticated through AgentCore Identity.
  • Architectures where the harness core runtime and execution tools share the same memory space without container isolation or least-privilege enforcement.

Mitigation and Detection

Remediation

  • Strict Tool Scoping (allowedTools): Explicitly configure the allowedTools parameter during invocation (InvokeHarness), disabling shell and file_operations tools unless strictly required by the session.
  • Least Privilege in Identity Vaults: Limit the scopes and permissions of service accounts associated with downstream integrations to minimize impact in case of a token leak.
  • Process Isolation and Sandboxing: Separate tool execution from the credential-handling core process using isolated containers or non-root user security boundaries.

Detection

  • Outbound Traffic Monitoring (Egress Filtering): Enforce strict egress filtering rules on harness containers. Any outbound connection to unauthorized endpoints or external webhooks must be treated as an immediate indicator of compromise (IoC).
  • Execution Log Auditing: Monitor anomalous execution of command interpreters (bash, python3) spawned by AI agent runtime processes.
bash 
# Conceptual monitoring rule to detect anomalous shell execution inside AI containers
# Detects shell execution spawned by Python server processes (loopy.server)
ps faux | grep -E "python3.*loopy\.server" -A 5 | grep -E "bash|sh|curl.*\|.*python"

“Encryption at rest and in transit protects data in storage and across the network, but memory in use remains a critical blind spot if the runtime grants unrestricted system privileges to the AI agent.”

Wrapping Up

The AWS AgentCore Harness case demonstrates that as AI agents gain increased autonomy and capability through advanced programmatic tools (such as full CLI shells and interpreters), the attack surface expands exponentially. An attacker’s ability to subvert model reasoning via prompt injection and harvest credentials directly from primary process memory underscores the urgent need to redesign isolation boundaries in modern AI runtimes, moving away from permissive out-of-the-box defaults.

References

  • Palo Alto Networks - Unit 42. (2026). A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity. Retrieved from https://unit42.paloaltonetworks.com/?p=187347
  • Amazon Web Services. (2026). Amazon Bedrock AgentCore Developer Guide: AgentCore Harness Tools.
  • Amazon Web Services. (2026). Amazon Bedrock AgentCore Developer Guide: Provide identity and credential management for agent applications with Amazon Bedrock AgentCore Identity.