Encryption at rest and in transit doesn’t help if, at the moment of use, the credential sits in plaintext in the memory of a process the agent can read. Unit 42 demonstrated this in AWS AgentCore Harness, and AWS decided the responsibility lies with the customer.
According to Unit 42’s report (Palo Alto Networks), under the default AgentCore Harness configuration, an indirect prompt injection can end in the theft of plaintext credentials managed by AgentCore Identity. A single support ticket with hidden instructions was enough to make the agent run a shell command, read the harness process memory, locate a live JWT, and send it to an attacker-controlled endpoint, as the Cloud Security Alliance summary also notes.
The root cause is a design issue: the shell and file_operations tools are available in every session unless you restrict them with allowedTools, they run as root, and they share a memory space with the process that decrypts the vault credentials.
Unit 42 reported the finding through HackerOne on May 19, 2026. AWS clarified the scope between June 8 and 10 and closed the report as “informative” under AgentCore’s shared responsibility model: there was no patch and no CVE, and AWS pointed to controls the customer can configure.
allowedTools at invocation, leaving only the tools that are strictly needed; (2) apply least privilege to the Identity vault’s service accounts for downstream integrations; (3) monitor outbound traffic from the harness containers. I would add a fourth: if an agent reads third-party content, don’t give it a shell. The broader lesson is that “the provider encrypts the credentials” does not mean “the agent can’t read them”: review each agent platform’s defaults before going to production.Carlos Montiel is an enterprise AI solutions architect. He implements LLMs, Agents, RAG, and orchestrators for companies across Guatemala and Latin America. Reach out for a consultation.
Contact Carlos Montiel