Credential Exfiltration in AWS AgentCore Harness via Default Shell Tool

Unit 42 researchers identified a significant security risk in AWS AgentCore Harness resulting from its default configuration. The harness provides a managed runtime for AI agents, which by default enables a 'shell' tool with root privileges within the execution container. This tool is designed to allow agents to perform autonomous tasks such as file manipulation and command execution. However, because this tool is enabled without explicit restriction, it creates a high-impact attack surface.

Attackers who successfully perform prompt injection against an agent can coerce the model into utilizing this shell tool to execute arbitrary commands. Because the shell runs as root within the harness's memory space, it can access sensitive data, specifically plaintext credentials managed by AWS AgentCore Identity that have been resolved for downstream integration use. This allows for the exfiltration of credentials used to authenticate agents with external services, effectively bypassing the intended security boundaries of the AgentCore Identity vault at runtime.

Impact

Successful exploitation allows an attacker to gain root access to the agent's container environment and exfiltrate credentials used to authenticate against downstream services and MCP servers. This impacts organizations relying on AgentCore Harness in production by potentially exposing sensitive internal systems to unauthorized access if the agent's underlying service account permissions are overly broad.

Recommendation

Prioritize the following remediation steps for all AWS AgentCore Harness deployments:

• Scope the 'allowedTools' parameter in the harness configuration to explicitly restrict access to only the tools necessary for the agent's intended function; specifically, disable the 'shell' and 'file_operations' tools unless strictly required.
• Implement the principle of least privilege for Identity vault service accounts by limiting their access exclusively to the downstream integrations they are required to support.
• Configure egress traffic filtering for all harness containers to block unauthorized connections to external command-and-control infrastructure.
• Review all current AgentCore Harness sessions to ensure that default tool capabilities are restricted, as the 'shell' tool is enabled out-of-the-box.