CVE-2026-78379 Overview
CVE-2026-78379 is a prompt injection vulnerability in the python_repl tool of Amazon Strands Agents Tools before version 0.8.5. Remote attackers can bypass the human consent gate and execute arbitrary Python code on the agent's host. The bypass works through a crafted prompt that forwards non_interactive_mode as a keyword argument via the batch tool. Exploitation requires no authentication and no user interaction on the target agent.
Critical Impact
Successful exploitation grants remote code execution on the agent host, allowing full compromise of the runtime environment and any credentials, data, or downstream systems accessible to the agent.
Affected Products
- Amazon Strands Agents Tools versions prior to 0.8.5
- Python environments using the strands-agents-tools package with the python_repl tool enabled
- LLM-driven agent deployments exposing the batch tool to untrusted prompt input
Discovery Timeline
- 2026-08-25 - CVE-2026-78379 published to the National Vulnerability Database
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-78379
Vulnerability Analysis
The flaw lies in how the python_repl tool validates execution requests originating from the language model. The tool implements a human consent gate that should require operator confirmation before running Python code on the host. That gate is controlled by the non_interactive_mode parameter.
When the batch tool forwards keyword arguments to nested tool calls, an attacker-controlled prompt can inject non_interactive_mode=True into a python_repl invocation. The consent prompt is skipped and the supplied code executes directly in the agent's Python runtime. The attacker only needs the ability to submit prompts that reach the agent, which in most deployments is the primary user-facing input surface.
Root Cause
The root cause is improper neutralization of input used for LLM prompting. The python_repl tool trusts keyword arguments assembled from prompt-derived tool calls without enforcing that the consent gate cannot be toggled by the model itself. Passing sensitive control parameters through the batch tool bypasses the intended safety boundary between LLM output and privileged tool actions.
Attack Vector
Exploitation is network-based when the agent is reachable through a chat interface, API, or webhook. The attacker crafts a prompt instructing the agent to invoke batch with a python_repl call and non_interactive_mode set to true, embedding arbitrary Python payloads. The payload runs with the privileges of the agent process. Details are available in the AWS Security Bulletin 2026-089.
Detection Methods for CVE-2026-78379
Indicators of Compromise
- Agent logs showing python_repl invocations with non_interactive_mode=True originating from model output rather than operator input
- batch tool calls that wrap python_repl with keyword arguments controlling consent or execution mode
- Unexpected outbound network connections, subprocess spawns, or filesystem writes from the agent host process
- Presence of strands-agents-tools package versions earlier than 0.8.5 in the Python environment
Detection Strategies
- Inspect prompt and tool-call telemetry for user inputs that reference non_interactive_mode, batch, or python_repl in combination
- Baseline the agent's normal tool-call patterns and alert on python_repl executions occurring without prior human consent events
- Review process trees rooted at the agent runtime for shell utilities, network clients, or credential access tools
Monitoring Recommendations
- Ship agent tool-call audit logs to a centralized log store and retain full prompt and response bodies for forensic review
- Enable host-based process and file integrity monitoring on servers running Strands agents
- Alert on installation or import of vulnerable strands-agents-tools versions across development and production environments
How to Mitigate CVE-2026-78379
Immediate Actions Required
- Upgrade strands-agents-tools to version 0.8.5 or later across all agent deployments
- Disable the python_repl tool in production agents that do not require dynamic code execution
- Rotate any credentials, API keys, or tokens accessible to affected agent hosts, assuming potential exposure
- Audit historical prompt and tool-call logs for exploitation attempts referencing non_interactive_mode
Patch Information
Amazon addressed the issue in Strands Agents Tools 0.8.5. The fix prevents non_interactive_mode from being toggled through prompt-driven tool call forwarding. Refer to the AWS Security Bulletin 2026-089 for the full vendor advisory.
Workarounds
- Remove or gate the batch tool so it cannot forward arbitrary keyword arguments to sensitive tools
- Run agents in isolated sandboxes or containers with minimal privileges, no outbound network access, and no persistent secrets
- Enforce an out-of-band approval workflow for any python_repl execution rather than relying on in-process consent flags
# Configuration example
pip install --upgrade 'strands-agents-tools>=0.8.5'
pip show strands-agents-tools | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
