Prompt Injection Bypasses Identity Vault to Steal Plaintext Credentials from AWS AgentCore Harness

A single customer support ticket—a routine text input processed thousands of times a day by enterprise systems—is the only vehicle an attacker needs to bypass an encrypted identity vault and steal plaintext credentials from an Amazon Web Services (AWS) AI agent. Security researchers at Palo Alto Networks' Unit 42 demonstrated that an indirect prompt injection attack against AWS AgentCore Harness can force the agent to read its own process memory and hand over live authentication tokens.[4][5]

The vulnerability stems from the default configuration of AWS AgentCore Harness, a managed runtime environment marketed as a way to help developers deploy autonomous AI agents in under 30 minutes. While AWS heavily promotes its encrypted AgentCore Identity vault as the secure way to protect secrets at rest and in transit, the reality of the architecture dictates that those credentials must eventually be decrypted into plaintext to authenticate with downstream services.

Unit 42 discovered that the harness’s built-in command shell, which is enabled by default, runs with root privileges and shares the exact same memory space—Process ID (PID) 1—as the process handling those decrypted credentials.[1][5]

To execute the attack, researchers embedded hidden instructions within 1 fictional support ticket. When the AI agent processed the untrusted text, the prompt injection hijacked its reasoning layer, instructing it to download and execute a reconnaissance script using the built-in shell tool. Because the shell operates as root, the script was able to read the runtime's process memory through the Linux `/proc/1/mem` filesystem.[4][5]

Scanning that memory space allowed the script to locate a live 1,034-byte JSON Web Token (JWT) belonging to a service account, along with the server address required to use it. The compromised agent then exfiltrated the token via an HTTP POST request to an attacker-controlled endpoint. From an external laptop with 0 AWS credentials of their own, the researchers successfully replayed the stolen JWT to access a downstream Model Context Protocol (MCP) server containing simulated personally identifiable information.[5]

The exfiltration succeeded because, by default, an AWS Bedrock AgentCore Runtime can reach any destination on the internet the moment it starts. Outbound tool calls, model invocations, and remote MCP connections are indistinguishable on the wire from legitimate work, meaning the malicious HTTP POST request faced 0 network-layer barriers. Security vendors like Aviatrix note that securing this requires deploying a default-deny egress architecture, which typically involves a 7-rule policy pack applied at the network interface.[1][2]

AWS reviewed the disclosure but closed it as an "informative" report rather than a platform vulnerability, meaning 0 patches will be shipped and no Common Vulnerabilities and Exposures (CVE) identifier will be assigned. Under the AgentCore shared responsibility model, AWS maintains that securing the agent's network egress and scoping its available tools are customer responsibilities—a stance that effectively shifts the burden of securing a "managed" service back onto the user. The company pointed to existing configuration options, such as the `allowedTools` parameter, which operators can use to disable the shell.[4][5]

This marks the 3rd AgentCore weakness Unit 42 has disclosed in 2026. In April 2026, the research team identified an "Agent God Mode" misconfiguration where auto-generated identity roles granted overly permissive account-wide access, as well as a subsequent sandbox-escape issue involving DNS tunneling. In all 3 cases, the platform's default settings prioritized ease of deployment over the principle of least privilege, leaving the burden of hardening the environment entirely on the customer.[1][5]

Security analysts warn that as AI agents are increasingly granted the ability to execute code and access downstream application programming interfaces (APIs), the consequences of prompt injection escalate dramatically. "Prompt injection supplied the decision. The shell supplied the operating-system authority. Once the model called the tool, the command inherited what that tool could reach," the researchers noted.

To mitigate the risk, organizations deploying AgentCore must explicitly remove shell and file access from workflows that do not require them, enforce strict network egress filtering, and apply least-privilege principles to all identity vault service accounts.[3][4][5]