Can an AI agent’s shell tool read credentials from its runtime memory? According to Unit 42, in the Amazon Bedrock AgentCore Harness configuration it tested, the built-in shell shared process memory with credential resolution and could access plaintext credentials there. That is a reported result for a tested setup—not evidence that every AgentCore deployment is exposed, or that AWS has had a service-wide breach.
The distinction matters: a vault protects credentials while stored, but a tool that can inspect the runtime may have a different opportunity once a credential has been retrieved for use. The risk depends on the Harness capabilities enabled for an invocation, the credential’s permissions, and the isolation between those capabilities.
As an Amazon Associate I earn from qualifying purchases.
What Unit 42 says it found
In its September 18, 2026 report, A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity, Palo Alto Networks’ Unit 42 describes testing an AgentCore Harness integration with AgentCore Identity and a downstream MCP server authenticated using a vault credential. Unit 42 reports that credential resolution placed plaintext credentials in the Harness process memory, and that the built-in shell tool in its tested configuration could access that memory. It also describes a prompt-injection path that steered agent actions.
This is Unit 42’s account of a test, not a new reproduction here. The report does not establish that all versions, configurations, or deployments behave this way. Nor does it establish a service-wide fix. Treat it as a concrete warning about the boundary between a credential being retrieved for use and other capabilities available in the same runtime.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Stored, retrieved, and in use are different states
- Stored: Identity’s token vault manages provider credentials and access tokens. AWS describes vault storage and OAuth flows in its AgentCore FAQ.
- Retrieved: A downstream integration needs a credential, which Identity supplies according to configured access controls.
- In use: The runtime must be able to use the retrieved credential to make the downstream call. Unit 42 says the shell in its tested setup could inspect the memory space where resolution occurred.
Encryption at rest addresses protection while data is stored; it does not, by itself, demonstrate isolation from another capability after the runtime has retrieved a credential. That distinction does not make at-rest encryption useless—it means it answers a different security question.
Harness and Identity have separate roles
AWS describes AgentCore Harness as the managed orchestration and runtime layer, and AgentCore Identity as the system for workload identities and credential access. Identity manages identities and credentials; the Harness configuration determines which tools and capabilities an agent can use. AWS describes workload identities as stable agent identities tied into the Identity directory and token vault.
In practical terms, the vault answers which credentials an identity can obtain, while Harness configuration affects what an agent can do with its runtime. A narrow credential does not compensate for an unnecessarily powerful tool, and a limited tool set does not make an overprivileged credential safe. Both controls—and the boundary between them—matter.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What AWS documents about the security boundary
AWS describes Harness access as protected by IAM or JWT authentication together with microVM isolation. Its security and access controls documentation says that principals passing the authorization gate can reach the capabilities configured on the Harness. It also assigns caller authorization and input validation to the customer.
AWS states: “The harness validates the structure of the request it accepts, but it does not inspect the meaning of prompts, screen content, or enforce behavioral constraints on the agent.” In other words, request-structure checks are not a guarantee that an agent will interpret a prompt safely or refuse a harmful action. AWS’s Harness guide also says: “The harness gives you the same security primitives as the rest of AgentCore, wired in by configuration.” These are statements about the documented design and responsibility split; they do not independently verify or refute Unit 42’s memory observation.
SigV4 and OAuth/JWT do not propagate identity in the same way
AWS distinguishes inbound authentication choices when a caller’s identity needs to carry through to downstream tool calls. Its security documentation says inbound OAuth with a Bearer JWT supports per-user credential scoping. It says SigV4 does not currently propagate per-user identity to downstream calls. The distinction is about identity propagation; neither option replaces application authorization, input validation, or careful tool and credential scoping.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Inbound path | Per-user identity propagated downstream? | User-scoped downstream credentials | Application controls |
|---|---|---|---|
| SigV4 / IAM | No, according to AWS’s security documentation. | Not through propagated per-user identity on this path, according to AWS. | The customer remains responsible for caller authorization and input validation. |
| OAuth / JWT Bearer token | Yes, AWS documents this path for passing per-user identity into downstream calls. | Available through per-user credential scoping, according to AWS. | The customer remains responsible for caller authorization and input validation, including validating the user context used for a request. |
AWS documentation is living material. The statements above reflect the behavior described in the documentation represented by the sources for this article; verify the current security guide before making an implementation decision, particularly if downstream per-user identity is a requirement.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →How to reduce the practical risk
Use several controls together. The point is to limit what an agent can reach, what its credentials permit, and what its runtime can send outward—not to rely on prompt defenses alone.
Restrict tools for each invocation
Unit 42 recommends scoping allowedTools per invocation. Enable only the tools needed for that task and avoid exposing a shell to model-directed actions unless the use case requires it. Where a shell is necessary, assess what it can access in the runtime and limit its authority and duration. This reduces unnecessary capability; it does not by itself establish process-level isolation.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Minimize Identity permissions
Give the relevant Identity service account access only to the credentials and downstream resources it needs. Prefer narrowly scoped credentials over broad, reusable access. Because a credential must be usable by the runtime after retrieval, limiting its permissions reduces the potential impact if it is exposed to another runtime capability.
Control and monitor outbound traffic
Unit 42 recommends egress filtering and outbound traffic monitoring. Restrict runtime destinations to those required by the workload, and monitor for unexpected connections. These measures can help constrain or identify data leaving the runtime; they do not prevent every form of misuse inside it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Validate callers and user context
AWS assigns authorization and input validation to the customer, and separately advises application-layer validation and sanitization when callers are not fully trusted. Check that the caller is allowed to invoke the requested capability, validate inputs before passing them to an agent, and ensure any mapping from an authenticated user to downstream access is trustworthy. Do not treat a well-formed request as proof that its intent is safe.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Review the full control set
| Control area | Review question | Why it matters |
|---|---|---|
| Harness tools | Which tools are enabled for this invocation, and can any inspect or act on runtime state? | Capabilities available to an agent shape what it can do if its actions are steered. |
| Identity permissions | Which secrets and downstream operations can the service identity access? | Credential scope limits the reach of a credential after retrieval. |
| Outbound destinations | Can the runtime connect only to required services, and are unexpected destinations monitored? | Egress controls can constrain and surface outbound misuse. |
| Caller and session mapping | Are caller authorization, inputs, and session-to-user mappings validated? | Downstream identity scoping is only useful when the authenticated user context is correctly established. |
These are decision points, not a benchmark: the cited sources do not rank implementations quantitatively. A configuration review should consider the controls together rather than treating any single one as a complete remedy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the disclosure does—and does not—establish
Unit 42 says it reported the issue to AWS Security on May 19, 2026. AWS requested reproduction details and clarification on June 8; on June 10, according to Unit 42, the report was merged with an earlier report and closed as informative under the shared-responsibility model. Unit 42 says AWS pointed to customer-side controls including allowedTools scoping and egress filtering.
That timeline records the disclosure handling described by Unit 42. It does not establish a CVE, a confirmed AWS-wide breach, how many customers may be affected, or a patch or service-wide fix. The report’s central practical point is narrower: when a credential is available in a runtime, assess whether other enabled capabilities can inspect or misuse that in-use state.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
