Description

Improper neutralization of input used for LLM prompting in the python_repl tool in Amazon Strands Agents Tools before 0.8.5 might allow remote actors to execute arbitrary Python code on the agent's host by bypassing the human consent gate, via a crafted prompt that forwards non_interactive_mode as a keyword argument through the batch tool. To remediate this issue, users should upgrade to version 0.8.5 or later.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-25T19:16:54.467Z",
  "pubdate": "2026-08-25T19:16:54.467Z",
  "executiveSummary": "The python_repl tool within Amazon Strands Agents, prior to version 0.8.5, is susceptible to an Improper Neutralization of Input used for LLM Prompting vulnerability.\nThis security flaw allows a remote actor to bypass the mandatory human consent gate, which is intended to restrict automated code execution.\nBy crafting a malicious prompt that injects the 'non_interactive_mode' keyword argument through the batch tool, an attacker can force the agent to execute arbitrary Python code directly on the host system.\nThe vulnerability represents a critical security risk as it facilitates remote code execution (RCE) with the privileges of the agent's environment.\nExploitation requires no pre-existing authentication if the agent is exposed to user-provided prompts, effectively turning the agent into a remote command execution vector.\nThe primary risk is the complete compromise of the underlying host system, allowing for unauthorized data access, lateral movement, or further malicious activity within the host environment.\nThe vulnerability is resolved by upgrading the software to version 0.8.5 or later, which implements necessary input sanitization and logic enforcement.",
  "technicalDetails": "The vulnerability is rooted in an insufficient validation mechanism within the interaction between the LLM-driven prompt processing and the python_repl tool in Amazon Strands Agents.\nThe system architecture employs a human consent gate designed to prevent the autonomous execution of code snippets generated by the LLM. However, the python_repl tool's interface is inadequately secured against parameter injection.\nSpecifically, the vulnerability arises because the batch tool fails to sanitize inputs before forwarding them to the python_repl component. An attacker can craft a prompt that includes the 'non_interactive_mode' keyword argument. When this payload is processed by the batch tool, the argument is forwarded to the python_repl tool, where it is improperly interpreted.\nThis injection causes the python_repl tool to bypass its internal security logic—specifically the routine that pauses execution to request human verification. By setting 'non_interactive_mode' to a truthy value, the actor instructs the agent to treat the execution request as pre-authorized.\nThe attack flow follows these steps: First, the attacker provides a specifically crafted natural language prompt to the agent. Second, the agent's LLM interprets this prompt and initiates a call to the batch tool. Third, the crafted 'non_interactive_mode' parameter is passed through the stack. Fourth, the python_repl tool receives this parameter, incorrectly identifying the request as non-interactive and thus skipping the human-in-the-loop consent gate. Fifth, the python_repl tool executes the malicious Python payload provided within the prompt context on the host system.\nThis execution happens with the same permissions as the Amazon Strands Agents process itself. As a result, the attacker can execute any Python code, including calls to system-level libraries, arbitrary file system operations, and network outbound connections. There are no authentication requirements for an attacker once they can provide input to the agent's LLM interface. This flaw effectively negates the intended security controls and permits persistent command execution, leading to full host compromise depending on the agent's configured environment and local privileges."
}