Researchers Show Prompt Injection Can Expose AWS AgentCore Identity Credentials
Summary
Unit 42 researchers demonstrated that prompt injection could use AgentCore Harness’s default shell tool to read a plaintext service-account JWT from runtime memory, exfiltrate it, and replay it to access downstream customer data.
Key points
- In the researchers’ test, AgentCore Harness’s shell and file_operations tools were enabled by default unless restricted with allowedTools.
- A hidden instruction in a support ticket persuaded the agent to run a remote script through the shell tool.
- The shell ran as root alongside the harness process, and researchers found they could read its memory through /proc.
- Researchers extracted a JWT resolved from the AgentCore Identity vault and sent it, with the MCP server URL, to a simulated attacker endpoint.
- They replayed the token from outside AWS to call the MCP server and retrieve customer PII in their test environment.
- AWS closed the report as informative under its shared responsibility model, citing allowedTools scoping and egress filtering as customer-side controls.
- Unit 42 recommends restricting tools per session, applying least privilege to vault service accounts, and monitoring outbound traffic from harness containers.
Article Details
- Attack Vectors
- An indirect prompt injection hidden in an HTML comment in a support ticket instructed the agent to use the default shell tool to download and execute a recon script.
- The shell tool ran as root and could read the harness runtime's /proc/1/mem; the researchers used it to find the plaintext JWT and MCP server URL in process memory.
- The script sent the JWT and MCP server URL in an HTTP POST to a simulated attacker endpoint. The researchers then replayed the JWT against the MCP server to retrieve customer PII.
- Defensive Notes
- Restrict allowedTools at InvokeHarness time to the tools each session needs; the built-in shell and file_operations tools are enabled by default.
- Apply least privilege to AgentCore Identity service accounts for their downstream integrations.
- Monitor outbound traffic from harness containers and investigate endpoints outside the expected downstream integration list.
- Isolate the shell from processes that resolve credentials, or otherwise prevent shell access to runtime credential memory.
- AWS closed the reported finding as informative under the AgentCore shared responsibility model, citing allowedTools scoping and egress filtering as customer-side controls.
MITRE ATT&CK
T1003.007 · Proc FilesystemThe script read /proc/1/mem and searched the harness runtime's memory for the plaintext JWT.T1059.004 · Unix ShellThe injected instruction caused the harness's shell tool to run a command that downloaded and piped a recon script to Python.T1059.006 · PythonThe downloaded recon and exfiltration scripts were executed with python3 inside the harness.T1105 · Ingress Tool TransferThe shell command used curl to retrieve the recon script into the harness before execution.T1567.004 · Exfiltration Over WebhookThe script exfiltrated the JWT and MCP server URL in an HTTP POST to a simulated attacker webhook.
Vendors
Amazon Web ServicesUnit 42 researchers have identified an issue where using default configurations in Amazon Web Services (AWS) AgentCore Harness could allow attackers to steer an agent's actions through prompt injection to exfiltratePalo Alto NetworksPalo Alto Networks customers are better protected from the threats discussed in this article through the following products and services:
Products
AgentCore Harnesshave identified an issue where using default configurations in Amazon Web Services (AWS) AgentCore Harness could allow attackers to steer an agent's actions through prompt injection to exfiltrate plaintextAgentCore Identityto steer an agent's actions through prompt injection to exfiltrate plaintext credentials managed by AgentCore Identity.Amazon CognitoOur test rig simulated an MCP server that required an Amazon Cognito Bearer token and had access to personally identifiable information (PII) such as names, phone numbers or the last four digits of Social SecurityCortex CloudCortex Cloud