LIVE FEED
HIGH PhantomRaven npm Stealer Built With LLM Targets Dev Secrets // HIGH SynthID Watermarking Weakens LLM Safety Guardrails Under Attack // HIGH RatHat Android Malware Uses Generative AI to Control Devices // FIRST LOOK OpenAI Reports Self-Injecting Prompts Found in Astra Compaction // CRITICAL OpenAI GPT-5.6 Sol Agents Hide Mistakes in Compaction Summaries // CRITICAL Heap Overflow and SSO Flaw Let Hackers Access OpenAI Repos // FIRST LOOK Base Labs and Hugging Face Launch Open-Weight AI Safety Standard // FIRST LOOK AWS AgentCore Harness Ships Built-In Shell and Identity Vault Tools // FIRST LOOK Apollo Research Launches Watcher to Monitor Rogue AI Agents // FIRST LOOK Anthropic Launches Claude Code Projects for Multi-Agent Cloud Orchestration //
FIRST LOOK ATLAS OWASP HIGH Significant risk · Prioritise patching First Look Agentic AI LLM Security Prompt Injection RELEVANCE ▲ 7.8

AWS AgentCore Harness Ships Built-In Shell and Identity Vault Tools

SOURCE Palo Alto Unit 42 ↗
FIRST LOOK HIGH ↗ RAPID
  • What shipped: AWS AgentCore Harness ships built-in shell and file_operations tools enabled by default alongside an AgentCore Identity credential vault.
  • Who benefits: Security and platform teams building on AgentCore benefit from this research by gaining a concrete runtime model and scoping controls to prevent unintended credential exposure.
  • Next steps: Scope allowedTools in every AgentCore Harness session to the minimum required set, explicitly removing shell and file_operations where not needed · Apply least-privilege IAM policies to AgentCore Identity vault service accounts for each downstream integration · Instrument egress monitoring on AgentCore harness containers to detect anomalous outbound connections as a detection-layer control
AWS AgentCore Harness Ships Built-In Shell and Identity Vault Tools

Defender Impact

Unit 42’s analysis of AWS AgentCore Harness delivers the first operationally grounded runtime model of how the platform’s built-in shell tool and Identity credential vault interact — closing a critical visibility gap for defenders who have been deploying agentic workloads without a clear picture of where credentials become plaintext and how they can be reached.

Capability Overview

AWS AgentCore Harness is a managed runtime for AI agents. Operators declare a model, tools, skills, and instructions; AgentCore handles compute, memory, identity, networking, and observability. On top of the operator’s declared configuration, the harness ships two built-in tools — shell (bash execution) and file_operations (file viewing, creation, and editing) — enabled in every session by default unless explicitly restricted via the allowedTools parameter.

AgentCore Identity is the platform’s recommended credential management layer: an identity vault with encryption at rest, encryption in transit, KMS key management, and IAM-gated access. The vault is designed to store credentials used by the harness when authenticating against downstream integrations such as MCP servers.

The Unit 42 research focused on what happens at runtime when a credential must leave the vault to be used. Their finding: the harness’s built-in shell tool operates within the same memory space where credentials are resolved to plaintext, and it runs as root. This means that without explicit allowedTools scoping, the shell tool has the same runtime reach as the credential resolution process — a significant exposure surface in the default out-of-the-box configuration.

AWS reviewed the disclosure and closed the report as informative under the AgentCore shared responsibility model, citing allowedTools scoping and egress filtering as customer-side controls.

Defensive Advances

This research delivers several concrete advances for defenders:

  • Runtime credential lifecycle visibility. Defenders now have a documented model of exactly when and where AgentCore Identity credentials transition from encrypted vault to plaintext in memory. This enables targeted container-layer monitoring rather than relying solely on vault-layer access logs.

  • Actionable allowedTools scoping pattern. The research establishes a precise, tested configuration pattern for restricting the harness’s tool surface. Defenders can use this as a policy baseline across all AgentCore deployments rather than discovering the exposure after the fact.

  • Least-privilege policy template for Identity vault service accounts. The guidance on scoping vault service accounts per downstream integration gives security teams a concrete IAM policy model, not just a general least-privilege recommendation.

  • Egress monitoring as a compensating control. The recommendation to instrument outbound traffic from harness containers provides a detection-layer control that integrates directly into existing CNAPP and SIEM workflows, giving defenders a runtime signal even when configuration controls are incomplete.

Residual Gaps

The defensive value here is real but conditional on operator maturity. The core limitation is that all recommended controls are opt-in: allowedTools scoping, vault service account least-privilege, and egress monitoring must each be actively configured. Teams without established cloud-native security baselines or agentic AI deployment experience may not realise these controls are needed until after deployment. There is also no native enforcement mechanism within AgentCore that prevents the shell tool from being active by default — the secure posture requires deliberate action at every session configuration.

Additionally, the research covers only two of AgentCore’s many integrations. The runtime credential exposure model likely applies to other vault-backed integrations, but defenders currently lack equivalent published analysis for those surfaces. Full coverage maturity will require either expanded research or AWS-provided runtime isolation documentation.

Framework Mapping

  • AML.T0051 (LLM Prompt Injection) and AML.T0086 (Exfiltration via AI Agent Tool Invocation): The shell tool’s default-on status is the mechanism by which prompt injection could escalate to credential exfiltration; allowedTools scoping directly addresses this pathway.
  • AML.T0083 (Credentials from AI Agent Configuration) and AML.T0098 (AI Agent Tool Credential Harvesting): The vault-to-plaintext runtime model maps directly to these techniques; egress monitoring provides the detection signal.
  • LLM08 (Excessive Agency): Default root-level shell access in a managed runtime is a textbook excessive agency pattern; the scoping guidance is the prescribed mitigation.
  • LLM06 (Sensitive Information Disclosure): Plaintext credential resolution in shared memory space is the disclosure mechanism; least-privilege vault scoping limits blast radius.

Deployment Considerations

Teams should treat this research as a configuration audit trigger for any existing AgentCore deployments. The first action is an inventory of active harness sessions to confirm whether allowedTools has been explicitly scoped. New deployments should enforce an organisation-wide baseline that removes shell and file_operations unless a documented use case requires them. Egress monitoring should be integrated into container observability pipelines before production deployment, not retrospectively.

Defender Checklist

  • Audit all active AgentCore Harness sessions for explicit allowedTools configuration; flag any sessions using defaults
  • Remove shell and file_operations from allowedTools in any session where bash execution and file I/O are not documented requirements
  • Apply least-privilege IAM policies to each AgentCore Identity vault service account, scoped to the specific downstream integration it serves
  • Instrument egress monitoring on all AgentCore harness containers; alert on unexpected outbound connections
  • Extend this runtime credential lifecycle review to other AgentCore vault-backed integrations beyond MCP servers
  • Include AgentCore allowedTools scoping in CI/CD pipeline validation to prevent permissive configurations reaching production

References

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.