A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity
Unit 42 researchers discovered a significant security vulnerability in AWS AgentCore Harness, a managed runtime for AI agents. Due to a default configuration, the built-in shell tool runs as root, allowing attackers to execute arbitrary commands and access sensitive data, even without misconfiguration. This vulnerability stems from the agent harness's ability to use programmatic tool use, which allows the model to write scripts and execute them directly within the runtime environment. The research demonstrated how a simple prompt injection attack could be leveraged to gain root access and exfiltrate data, highlighting a critical security gap in the agent runtime's design. AWS has acknowledged the issue and closed the report as informative under their shared responsibility model.
Unit 42 researchers have identified a critical security vulnerability in AWS AgentCore Harness, a managed runtime for AI agents. The issue stems from the harness's default configuration, where the built-in shell tool runs as root, granting attackers full access to the operating system environment. This vulnerability is directly linked to the agent harness's ability to leverage programmatic tool use, a feature that allows the model to write and execute scripts directly within the runtime environment.
To reach this finding, researchers examined two of the harness’s integrations: AWS AgentCore Identity, a platform for managing agent identities and storing credentials, and a downstream Model Context Protocol (MCP) server, which the harness authenticates against using credentials from the Identity vault. AgentCore Identity provides encryption at rest, encryption in transit, key management service (KMS) keys, and IAM-gated access, but the core issue lies in the runtime configuration.
What makes this particularly dangerous is that the vulnerability doesn't require any misconfiguration. Simply enabling the built-in shell tool – which is enabled by default – allows an attacker to execute arbitrary commands and read or write files, regardless of whether they asked for those tools or not. Researchers demonstrated this by using a simple prompt injection attack to instruct the model to curl a reconnaissance script and pipe it into Python3, ultimately running the script as root within the harness.
Their testing revealed that the shell tool runs as root, providing full visibility into the operating system environment. This means that an attacker could use the shell tool to explore the entire file system, access process information, and potentially exfiltrate sensitive data. The researchers used commands like `whoami` and `id` to confirm that the entire chain of processes – from the harness runtime (PID 1) to the reconnaissance script (PID 40) – were running under the same root user.
AWS has acknowledged the report and closed it as informative under their AgentCore shared responsibility model. However, this highlights a significant gap in the agent runtime's security design and underscores the importance of careful configuration and ongoing monitoring.
For operators building on AgentCore today, defense takes a layered approach: scope the allowedTools the harness can use to what it needs, scope Identity vault service accounts to least privilege for the downstream integration, and watch outbound traffic from your harness containers. Palo Alto Networks customers are better protected through products and services like Unit 42 Cloud Security Assessment, which identifies misconfigurations and security gaps. If you suspect a compromise, contact the Unit 42 Incident Response team.