Affected Systems
AWS AgentCore Harness, all versions using default configurations with built-in shell and file_operations tools enabled. Affects deployments using AWS AgentCore Identity for credential management and downstream MCP server integrations.
Exploitation Status
Proof-of-concept demonstrated by Unit 42 researchers. Exploitation requires prompt injection attack against an agent using default configurations. No CVE assigned. AWS closed disclosure as informative, citing shared responsibility model.
Business Impact
Default-enabled shell tool runs as root and accesses the same memory space where AgentCore Identity resolves credentials to plaintext. Attackers using prompt injection can steer agent actions to exfiltrate credentials for downstream services. Risk is highest for organizations deploying AgentCore agents without scoping allowedTools or implementing egress filtering. No patch available—mitigation relies entirely on customer-side configuration controls.
Urgency
🟠 Within 24 hours
Recommended Actions
- Immediately scope the allowedTools parameter in all AgentCore Harness sessions to only the tools each session requires—disable shell and file_operations unless explicitly needed
- Apply least privilege to all service accounts stored in AgentCore Identity vaults, limiting downstream integration permissions to minimum required scope
- Implement egress filtering and monitor outbound traffic from AgentCore Harness containers for unexpected credential exfiltration attempts
- Review existing AgentCore deployments for use of default configurations and audit agent session logs for suspicious shell command execution
- Evaluate Cortex Cloud or equivalent tooling to detect prompt injection patterns targeting agentic AI workloads