Unit 42 researchers found that default configurations in AWS AgentCore Harness could let attackers use prompt injection to steer an agent's actions and exfiltrate plaintext credentials managed by AgentCore Identity. The researchers examined two integrations: AgentCore Identity, which stores credentials, and a downstream Model Context Protocol (MCP) server authenticated with a credential from that vault. Although AgentCore Identity provides encryption at rest, encryption in transit, KMS keys and IAM-gated access, the researchers examined runtime, when a credential leaves the vault. They found the harness's built-in shell tool, enabled by default, reaches into the same memory space where credentials are resolved to plaintext. AWS reviewed and closed the report as informative under the AgentCore shared responsibility model, citing allowedTools scoping and egress filtering as customer-side controls. Recommended defenses include scoping the allowedTools the harness can use, scoping Identity vault service accounts to least privilege for the downstream integration, and watching outbound traffic from harness containers. Palo Alto Networks customers are protected through Cortex Cloud, and Unit 42 Cloud Security Assessment reviews cloud infrastructure for misconfigurations and security gaps.