AIDEFEND SecureFlow / SecureFlow Case Index

AgentCore Harness Identity Credential Exfiltration and Replay

• Autonomous Agents
• Credential & Identity Theft

Unit 42's controlled SupportCo scenario placed instructions in an inbound support ticket. With a permissive model and default shell tool, the agent fetched and ran a recon script as root in AgentCore Harness. The shell shared UID and readable /proc/1/mem access with the harness process; researchers recovered a plaintext JWT for the operator's downstream MCP service account and its endpoint. The injected script sent both in one HTTP POST to a simulated attacker webhook; the researchers replayed the JWT from a laptop and retrieved sample customer PII through the downstream MCP server. AWS treated this as shared-responsibility configuration guidance, not a patched service vulnerability.