⚠️ Region Alert: UAE/Middle East
Unit 42 researchers discovered a vulnerability in the default configuration of Amazon Web Services (AWS) AgentCore Harness that allows attackers to exfiltrate plaintext credentials via prompt injection. The issue stems from the harness's built-in shell tool, which is enabled by default and operates with root privileges. This elevated access allows an attacker to read the process memory of the harness runtime, where credentials managed by the AgentCore Identity vault are resolved into plaintext during use.
While AWS provides robust encryption for credentials at rest and in transit, this research highlights that they remain vulnerable while "in use" if isolation boundaries are not properly maintained. AWS has categorized this finding as part of the shared responsibility model, emphasizing that customers must manually scope tools and implement egress filtering. To defend against such attacks, organizations should apply the principle of least privilege to service accounts and strictly limit the tools available to agent sessions.
Top comments (0)