AWS AgentCore Harness Vulnerability Allows Prompt Injection to Exfiltrate Credentials
Researchers discovered a flaw in AWS AgentCore Harness's default configuration that allows prompt injection to exfiltrate plaintext credentials.
Unit 42 researchers have uncovered a security vulnerability within Amazon Web Services (AWS) AgentCore Harness, a managed runtime environment for AI agents. The issue stems from the default configuration of the harness, which, when combined with its built-in shell tool, allows for prompt injection attacks. These attacks can be leveraged to exfiltrate sensitive credentials that are managed by AgentCore Identity, the platform's recommended solution for storing and managing agent credentials.
The vulnerability arises because the default shell tool, enabled out-of-the-box, operates within the same memory space where AgentCore Identity resolves credentials to their plaintext form at runtime. This means that an attacker who can successfully inject malicious prompts into the agent's input can trick the agent into executing commands that access and leak these resolved credentials. The researchers noted that this behavior is not dependent on any misconfiguration by the user; it is the default state of the harness.
AWS AgentCore Identity itself offers robust security features, including encryption at rest and in transit, integration with Key Management Service (KMS) keys, and access controls via Identity and Access Management (IAM). However, the research highlights that these protections do not extend to the credentials once they are retrieved from the vault and made available to the agent for operational use. The harness's built-in shell tool, running with root privileges by default, has the capability to access this sensitive runtime memory.
AWS has reviewed the findings and classified the issue as informative, placing the responsibility for mitigation on the customer under the AgentCore shared responsibility model. The company recommends several customer-side controls to address the risk. These include carefully scoping the allowedTools parameter to only include necessary tools for each agent session, applying the principle of least privilege to the Identity vault service accounts used by downstream integrations, and monitoring outbound network traffic originating from harness containers.
The AgentCore Harness is designed to bridge the gap between an AI model's reasoning capabilities and its ability to take action. It provides essential infrastructure like tools, a sandboxed shell, persistent memory, and identity management, enabling agents to operate autonomously. The built-in shell tool, while a powerful feature for enabling agents to perform tasks like writing files or executing code, also represents a significant attack surface if not properly managed.
To mitigate this vulnerability, users are advised to restrict the allowedTools parameter. By default, the harness includes tools like shell and file_operations unless explicitly limited. Limiting these tools to only those required for a specific agent's function can prevent unauthorized command execution and credential exfiltration. This proactive configuration is crucial for maintaining the security posture of AI agents operating within the AWS ecosystem.
Furthermore, the principle of least privilege should be applied to the service accounts that AgentCore Identity uses to authenticate with downstream services. By granting these accounts only the minimum necessary permissions, the potential impact of a compromised agent is significantly reduced. Finally, vigilant monitoring of outbound network traffic from harness containers can help detect and alert on any suspicious data exfiltration attempts.