Vulnerability AWS AgentCore: Credentials at Risk with Default Configurations

Critical Vulnerability in AWS AgentCore Harness: Credential Exfiltration in Plaintext

An unmodified default configuration in AWS AgentCore Harness exposes users to the risk of sensitive credential exfiltration. The vulnerability, identified by Unit 42 researchers, allows attackers to manipulate agent actions through prompt injection, exploiting direct access to credentials managed by AgentCore Identity.

Quick Response

The Technical Analysis of the Vulnerability

The investigation focused on two fundamental components: AWS AgentCore Identity and a Model Context Protocol (MCP) server. AgentCore Identity, which manages agent identities and stores credentials in a vault, implements encryption at rest, in transit, KMS key management, and controlled access via IAM. However, the problem arises during execution when a credential must leave the vault to be used.

The researchers discovered that the harness's built-in shell tool, enabled by default, accesses the same memory space where credentials are resolved in plaintext. This means an attacker could induce the agent to execute commands that exfiltrate these sensitive credentials.

The AWS Shared Responsibility Model

The vulnerability was reported to AWS, which evaluated the report as informative within the context of its shared responsibility model. AWS cited allowedTools scoping and egress filtering as customer-side controls that operators should implement to mitigate the risk.

The Architecture of the Problem: When Autonomy Becomes a Risk

AWS AgentCore Harness is a managed runtime for AI agents, designed to automate complex tasks. The harness includes two built-in tools enabled by default: shell and file_operations. While these tools are useful for agent autonomy, they represent a significant attack vector when not properly configured.

The fundamental problem lies in the fact that the shell tool runs as root within the harness. This means any command executed by the agent inherits the same elevated privileges, potentially allowing an attacker to perform harmful operations on the system.

The Security Implications for Zero Trust Architectures

This vulnerability raises important questions for zero trust architecture implementations. In a context where access is based on continuous verification and least privilege, uncontrolled access to powerful tools like the built-in shell represents a violation of fundamental security principles.

Defensive Measures for Operators

To mitigate this risk, operators should adopt a multi-layered defensive approach. This includes limiting the tools allowed in the harness to those strictly necessary for each session, minimizing vault identity privileges, and carefully monitoring traffic egressing from harness containers.

For organizations seeking comprehensive managed SOC or MDR service solutions, it is essential to integrate these controls with advanced monitoring solutions that can detect anomalous behaviors.

The Evolution of AI Agents and New Attack Vectors

As AI agents become more capable and autonomous, the shift towards programmatic tool use has introduced new attack vectors. Before the development of programmatic tools, a prompt injection could only influence the agent's textual output. With the introduction of the shell tool, an attacker can now directly manipulate the agent's runtime at its privilege level.

The Importance of NIS2 and DORA Compliance

This vulnerability underscores the importance of implementing robust security controls in line with the NIS2 Directive and the DORA Regulation. Organizations must ensure their systems are designed with digital operational resilience and can withstand evolving threats.

For companies seeking to optimize cyber insurance costs, this case highlights the importance of implementing proactive security measures that can reduce the risk of costly security incidents.

The Implications for Identity and Access Management

The vulnerability also highlights the importance of proper identity access management (IAM) implementation. Operators must ensure that agent identities are configured with least necessary privileges and that access to sensitive tools is strictly controlled.

For organizations seeking advanced sensitive data protection solutions, it is essential to implement granular access controls that can limit the exposure of sensitive credentials.

Palo Alto Networks Solutions

Palo Alto Networks offers several solutions to help users protect themselves from these threats. The Unit 42 Cloud Security Assessment is an assessment service that examines cloud infrastructure to identify misconfigurations and security gaps. For organizations that have suffered a compromise or have an urgent issue, the Unit 42 Incident Response team is available to provide immediate support.

The Evolution of AI Agents and New Attack Vectors

The Implications for Identity and Access Management