Palo Alto Networks’ Unit 42 researchers have discovered a vulnerability in AWS’ AgentCore Harness that could potentially lead to the extraction of plaintext credentials managed by AgentCore Identity. This indirect prompt-injection attack was demonstrated by embedding malicious instructions in external content, taking advantage of the default Harness configuration.
AgentCore Harness, built on AgentCore Runtime, provides agents with various capabilities such as tools, memory, identity, networking, and access to external services. The attack scenario involved manipulating a support ticket processed by a simulated customer support agent connected to an external Model Context Protocol (MCP) server authenticated through AgentCore Identity.
By inserting hidden instructions into the support ticket, researchers were able to execute a prompt-injection attack within the Harness environment. This allowed them to access the memory of the runtime process and retrieve plaintext credentials stored in AgentCore Identity. The extracted JSON Web Token (JWT) was then sent to an external endpoint controlled by the attacker.
Unit 42’s proof of concept highlighted the importance of restricting access to built-in tools, monitoring outbound network traffic, and limiting privileges associated with service accounts stored in AgentCore Identity. AWS recommends implementing measures such as allowedTools scoping and network egress controls to mitigate such attacks.
In response to the issue reported by Unit 42, AWS acknowledged the vulnerability and recommended security controls that customers can implement to enhance protection. The shared responsibility model outlined by AWS emphasizes the importance of IAM policies, input validation, agent code security, and network configuration as customer responsibilities.
Overall, the research conducted by Unit 42 sheds light on the potential risks associated with tool-enabled agents and underscores the need for proactive security measures to safeguard sensitive data in cloud environments.
