CVE-2026-18733: Amazon Strands Agents Tools RCE Flaw

CVE-2026-18733 Overview

CVE-2026-18733 is a prompt injection vulnerability in the shell tool of Amazon Strands Agents Tools versions before 0.8.0. Remote actors can execute arbitrary operating system commands on the agent's host by supplying a crafted prompt that sets the non_interactive parameter to true. This value bypasses the human consent gate that normally requires user approval before shell execution. The flaw affects AI agent deployments that expose the shell tool to untrusted input sources such as external documents, web content, or user-supplied prompts.

Critical Impact
Attackers can achieve arbitrary command execution on the agent host by injecting a prompt that flips the non_interactive flag, bypassing human-in-the-loop safeguards.

Affected Products

Amazon Strands Agents Tools versions prior to 0.8.0
Python package strands-agents-tools distributed via PyPI
AI agent deployments importing the shell tool from the affected package

Discovery Timeline

2026-08-03 - CVE-2026-18733 published to the National Vulnerability Database
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-18733

Vulnerability Analysis

The shell tool in Amazon Strands Agents Tools executes operating system commands on behalf of an AI agent. The tool includes a human consent gate that requires interactive approval before running commands. This safeguard blocks the agent from executing shell operations without operator awareness.

The tool accepts a non_interactive parameter that, when set to true, disables the consent prompt and runs commands directly. An attacker can influence the agent through prompt injection to invoke the tool with this parameter enabled. Any content the agent processes, such as retrieved documents, tool outputs, or external URLs, becomes a viable injection surface.

Once the parameter bypass succeeds, the agent executes attacker-controlled commands under the privileges of the host process. This leads to arbitrary code execution, credential theft, lateral movement, or data exfiltration depending on the host context.

Root Cause

The consent gate treats non_interactive=true as a trusted operational setting rather than a security-sensitive control. The tool does not distinguish between operator intent and model-influenced parameter selection. Prompt injection payloads therefore reach a code path that intentionally skips human approval.

Attack Vector

An attacker plants instructions inside content the agent will ingest. Example vectors include a web page fetched by the agent, a file the agent summarizes, or a chat message routed through the agent. The injected instructions direct the agent to call the shell tool with non_interactive=true and an attacker-specified command. Execution then occurs on the agent's host without operator confirmation. No authentication to the agent host is required if the agent processes untrusted input.

The vulnerability mechanism is documented in the GitHub Security Advisory GHSA-mqvc-p852-wf8x and the AWS Security Bulletin 2026-072.

Detection Methods for CVE-2026-18733

Indicators of Compromise

Agent log entries showing shell tool invocations with non_interactive set to true from untrusted or unexpected prompt contexts
Unexpected child processes spawned by the Python interpreter hosting the Strands agent
Outbound network connections initiated by the agent host immediately following a shell tool call
Files, cron jobs, or SSH keys created or modified by the agent process outside of documented workflows

Detection Strategies

Audit application logs for shell tool calls and alert on any invocation where non_interactive=true originated from model output rather than operator configuration
Monitor process ancestry for shells (bash, sh, cmd.exe, powershell.exe) spawned by the agent runtime
Correlate prompt content ingested by the agent with subsequent tool invocations to identify injection attempts

Monitoring Recommendations

Enable verbose tool-call logging within the Strands agent and forward events to a central SIEM for review
Baseline normal command patterns for the agent and alert on deviations such as reconnaissance commands (whoami, id, curl) or credential access
Track the installed version of strands-agents-tools across environments to confirm upgrade compliance

How to Mitigate CVE-2026-18733

Immediate Actions Required

Upgrade strands-agents-tools to version 0.8.0 or later on all agent hosts
Inventory every deployment importing the shell tool and confirm the running package version
Rotate credentials, API tokens, and cloud keys accessible to any agent host that ran a vulnerable version and processed untrusted input
Review historical agent logs for shell tool invocations that used non_interactive=true

Patch Information

Amazon released the fix in strands-agents-tools version 0.8.0. Install the fixed release from the PyPI Project Release Notes 0.8.0. Refer to the AWS Security Bulletin 2026-072 for vendor guidance.

Workarounds

Remove the shell tool from the agent's tool set if it is not required for the workload
Run the agent process under a low-privilege service account with restricted filesystem and network access
Isolate the agent runtime inside a container or sandbox with egress filtering to limit post-exploitation impact
Restrict agent input sources to trusted content and apply prompt-injection filtering on external data before it reaches the model

bash

# Upgrade to the fixed release
pip install --upgrade 'strands-agents-tools>=0.8.0'

# Verify the installed version
pip show strands-agents-tools | grep -i version