UNIT 42 researchers say default configurations in Amazon Web Services (AWS) AgentCore Harness can allow prompt injection to expose plaintext credentials managed by AgentCore Identity. The researchers examined a harness using the Identity vault to authenticate with a downstream Model Context Protocol (MCP) server. Although the vault encrypts credentials at rest and in transit, the credential must be resolved in plaintext at runtime.
They found that AgentCore’s built-in shell tool, enabled by default, ran as root in the same process environment and could read the memory of the harness runtime, including `/proc/1/mem`.
In a test environment, an indirectly injected instruction in a support ticket caused the agent to use the shell to run a script. The script found a 1,034-byte JSON Web Token (JWT) and the MCP server URL in the runtime heap, then sent both to a simulated attacker’s webhook. The researchers replayed the token from a laptop without AWS credentials, using it to access MCP tools that returned customer personally identifiable information (PII) and created a ticket.
They said the token represented the operator’s `mcp-service` account, rather than the invoking user. Unit 42 reported the finding to AWS on 19 May 2026; AWS merged it with an earlier report and closed it as informative on 10 June 2026 under the AgentCore shared responsibility model.
The researchers recommend restricting `allowedTools` at `InvokeHarness` time, removing the default shell and `file_operations` tools where unnecessary, limiting Identity service accounts to least privilege and monitoring outbound traffic from harness containers. They also said AWS operators should recognise that vault protections do not secure credentials once they are in use, and that shell execution should be isolated from processes handling plaintext secrets.