AWS Strands Agents CVE-2026-78379 Remote Code Execution via Crafted Prompt in python_repl
A crafted prompt can bypass human approval gates in the Strands Agents python_repl tool, allowing remote actors to execute arbitrary code on the host.
Key points
- CVE-2026-78379 allows bypassing the consent gate in Strands Agents Tools versions prior to 0.8.5.
- Attackers use a crafted prompt to forward non_interactive_mode via the batch tool.
- AWS released version 0.8.5 to fix the improper input neutralization issue.
Amazon Web Services published security bulletin 2026-089-AWS on August 25, 2026, detailing a consent bypass vulnerability in its open-source Strands Agents SDK. The flaw, tracked as CVE-2026-78379, affects the strands-agents-tools package. Specifically, it impacts the python_repl tool, which is designed to execute Python code on the agent's host machine after obtaining operator approval.
The risk
The python_repl tool normally prompts an operator for approval before running any code. However, AWS identified that improper neutralization of input used for large language model prompting allows this gate to be bypassed. Remote actors can exploit this by sending a crafted prompt. This prompt forwards the non_interactive_mode keyword argument through the batch tool, which invokes multiple tools in a single call.
Who is exposed
This vulnerability affects installations of Amazon Strands Agents Tools before version 0.8.5. The exploit requires both the batch tool and the python_repl tool to be registered on the same agent. If an agent processes untrusted content with these tools available, the host is at risk. The issue is specific to the Python SDK environment provided by AWS for building and running AI agents.
Cost and compliance
AWS classifies this bulletin as important, requiring attention. The vendor has addressed the issue in strands-agents-tools version 0.8.5. In this update, the python_repl tool reads the non_interactive_mode flag only from the STRANDS_NON_INTERACTIVE environment variable. This ensures the operator sets the flag, preventing callers from supplying it through prompts.
What to watch
Teams should verify their current version of strands-agents-tools immediately. If running a version older than 0.8.5, prioritize upgrading to the latest release. For environments where immediate patching is not possible, administrators must remove either the batch or python_repl tool from the agent's tool list to break the attack chain.
Signals worth monitoring
Security teams usually detect this activity by reviewing agent execution logs for unexpected code runs. Look for python_repl invocations that lack corresponding human approval records. Check whether the batch tool is triggering sub-tools with non_interactive flags. Verify that environment variables match expected configurations. Containment moves involve isolating the affected agent and revoking its network access to prevent lateral movement or data exfiltration.
What to do and how to stay safe: AWS
- Upgrade strands-agents-tools to version 0.8.5 or later to apply the vendor fix.
- Remove either the batch or python_repl tool from agent configurations if patching is delayed.
- Ensure agents processing untrusted content do not have access to the python_repl tool.
- Run agents using python_repl in isolated, least-privilege environments to contain potential code execution.
Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First
General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-78379?
It is a consent bypass vulnerability in the Strands Agents Tools python_repl tool that allows arbitrary code execution.
Which versions are affected?
Versions of strands-agents-tools prior to 0.8.5 are impacted by this security flaw.
How can I mitigate the risk without updating?
Remove either the batch or python_repl tool from the tool list passed to the agent.
