A Vault with a Heap-View: credentials in AWS Bedrock AgentCore Harness

If your agent runtime ships a shell tool, it also ships a memory-reading tool. Unit 42 showed that Bedrock AgentCore Harness runs shell and file_operations as root by default, inside the same process where Identity decrypts vault credentials. A prompt injection reads /proc/1/mem and walks off with a 1,034-byte JWT that replays from anywhere, no AWS credentials required. allowedTools is not an optional parameter.