Executive brief
Amazon Strands Agents is an SDK for building and running AI agents, which includes tools that execute code on behalf of the operator. The python_repl tool normally requires human approval before running Python code to prevent misuse. A consent bypass vulnerability allows remote attackers to skip this approval gate by crafting a malicious prompt that passes parameters through the batch tool, leading to arbitrary code execution on the agent's host.
Technical details
CVE-2026-78379 is a prompt injection / consent bypass vulnerability in the python_repl tool within Amazon Strands Agents Tools. The root cause is improper neutralization of input used for LLM prompting, allowing an attacker to forge a crafted prompt that passes the non_interactive_mode keyword argument through the batch tool to bypass the human consent gate. The attack is network-accessible if the agent is exposed to remote input and requires no authentication or user interaction beyond the agent processing the malicious prompt. An attacker can execute arbitrary Python code on the agent's host by bypassing the intended approval mechanism. The vulnerability affects versions before 0.8.5, and a patch is available in 0.8.5 or later.
Affected products
- Amazon Strands Agents Tools < 0.8.5
Timeline
- 2026-08-25: disclosed
- 2026-09-09: advisory