A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity

Unit 42 demonstrates that AWS AgentCore Harness, in default configuration, exposes a high-impact attack surface: its built-in shell and file operations run with the harness execution UID (root in the tested instance) and can be manipulated via prompt injection to run commands that read the harness process memory, extract plaintext JWT credentials from the AgentCore Identity vault, and replay them against downstream MCP services to access customer PII; mitigations include scoping allowedTools, least-privilege vault accounts, and egress monitoring.