/
← Voltar ao feed
high

Prompt injection in AWS AgentCore Harness default config lets the root shell tool steal plaintext AgentCore Identity credentials

1 fonte(s) · 1 atualização(ões) · publicado 18/09/2026 07:00 · coletado há 3 dias

Unit 42 researchers found that in default AWS AgentCore Harness deployments, prompt injection can steer the agent's built-in shell tool to exfiltrate plaintext credentials resolved from AgentCore Identity. The shell tool is enabled by default and runs as root, in the same UID as the harness runtime (PID 1, python3.10 -m loopy.server). That lets injected commands read /proc/1/mem, where vault ARNs have already been resolved into plaintext secrets. In the proof of concept, a hidden instruction in a support ticket made the agent exfiltrate a Cognito JWT for the operator's mcp-service account and the MCP server URL. The JWT was then replayed from the internet to retrieve customer PII. AWS closed the report (HackerOne #3747844, merged with #3737800) as informative under the AgentCore shared responsibility model, so no vendor fix is implied. Defenders must apply customer-side controls.

Detalhes técnicos

  • Primitive: indirect prompt injection via a hidden HTML comment in a support ticket told the agent to curl a recon script and pipe it into python3. A permissive model was selected per invocation after the default model refused direct prompting.
  • Recon: whoami/id showed the shell tool running as root. With no ps available, the process list was read from /proc. PID 1 was the loopy server, and bash and the payload were its descendants under the same UID.
  • Memory access: /proc/1/maps gives the address-space layout, then /proc/1/mem is read region by region. The script pid1_identity_recon_exfil.py scanned the heap for a JWT pattern and the MCP server URL.
  • Exfiltration: one JWT (1,034 bytes) and the MCP URL were sent in a single HTTP POST to a webhook.site endpoint.
  • Replay: the token was replayed against the MCP server from a laptop with no AWS credentials. The attacker listed tools, called lookup_customer (names, phone numbers, last four SSN digits) and created a ticket.
  • Impact scope: the stolen credential is the operator's vault service account (mcp-service), not the end user's token. It carries authority the caller never had. allowedTools only scopes tools at InvokeHarness time, not at CreateHarness, which is easy to miss.
  • No in-the-wild exploitation is reported. This is researcher-driven testing.

Remediação

  • Scope allowedTools at InvokeHarness time to what each session needs, and disable the default shell and file_operations tools where they are not required.
  • Apply least privilege to every Identity vault service account used for downstream integrations.
  • Monitor and filter egress from harness containers. Any destination outside the downstream integration list indicates active injection.
  • For runtime builders: keep resolved credentials where the shell tool cannot read them, or run the shell tool in a sandbox isolated from the credential-resolving process.

Linha do tempo

  1. unit42.paloaltonetworks.com ↗ · pub. 18/09/2026 07:00 · coletado 19/10 17:56 primeiro registro

    Prompt injection in AWS AgentCore Harness default config lets the root shell tool steal plaintext AgentCore Identity credentials

    ler a análise desta fonte

    Unit 42 researchers found that in default AWS AgentCore Harness deployments, prompt injection can steer the agent's built-in shell tool to exfiltrate plaintext credentials resolved from AgentCore Identity. The shell tool is enabled by default and runs as root, in the same UID as the harness runtime (PID 1, python3.10 -m loopy.server). That lets injected commands read /proc/1/mem, where vault ARNs have already been resolved into plaintext secrets. In the proof of concept, a hidden instruction in a support ticket made the agent exfiltrate a Cognito JWT for the operator's mcp-service account and the MCP server URL. The JWT was then replayed from the internet to retrieve customer PII. AWS closed the report (HackerOne #3747844, merged with #3737800) as informative under the AgentCore shared responsibility model, so no vendor fix is implied. Defenders must apply customer-side controls.

    Technical Details

    • Primitive: indirect prompt injection via a hidden HTML comment in a support ticket told the agent to curl a recon script and pipe it into python3. A permissive model was selected per invocation after the default model refused direct prompting.
    • Recon: whoami/id showed the shell tool running as root. With no ps available, the process list was read from /proc. PID 1 was the loopy server, and bash and the payload were its descendants under the same UID.
    • Memory access: /proc/1/maps gives the address-space layout, then /proc/1/mem is read region by region. The script pid1_identity_recon_exfil.py scanned the heap for a JWT pattern and the MCP server URL.
    • Exfiltration: one JWT (1,034 bytes) and the MCP URL were sent in a single HTTP POST to a webhook.site endpoint.
    • Replay: the token was replayed against the MCP server from a laptop with no AWS credentials. The attacker listed tools, called lookup_customer (names, phone numbers, last four SSN digits) and created a ticket.
    • Impact scope: the stolen credential is the operator's vault service account (mcp-service), not the end user's token. It carries authority the caller never had. allowedTools only scopes tools at InvokeHarness time, not at CreateHarness, which is easy to miss.
    • No in-the-wild exploitation is reported. This is researcher-driven testing.

    Remediation

    • Scope allowedTools at InvokeHarness time to what each session needs, and disable the default shell and file_operations tools where they are not required.
    • Apply least privilege to every Identity vault service account used for downstream integrations.
    • Monitor and filter egress from harness containers. Any destination outside the downstream integration list indicates active injection.
    • For runtime builders: keep resolved credentials where the shell tool cannot read them, or run the shell tool in a sandbox isolated from the credential-resolving process.