AWS fixes Strands Agents flaw that let a crafted prompt make an agent reveal host credentials

Amazon Web Services published a security bulletin on October 28 about CVE-2026-115415 in strands-agents-tools, an open-source Python package of pre-built tools for the Strands Agents SDK. The package's environment tool lets an agent list, read, set and delete environment variables on its host, and by default it masks values that look like secrets. According to AWS, the tool accepted a masking parameter from the language model through its tool schema. A crafted prompt delivered in content the agent was asked to process could tell the model to call the tool with masking turned off. The tool would then return the host's environment variables in cleartext, including cloud credentials and API keys, without asking the operator for consent. Versions 0.1.0 up to but not including 0.8.6 are affected. Version 0.8.6 fixes the issue: only the operator controls masking now, and the model can no longer turn it off. The environment tool is also deprecated as of that release. AWS recommends upgrading, patching any forked or derivative code, and rotating any credentials that were in the environment of agents that loaded the tool. The bug shows a weakness common to agent toolkits: a safety setting that the model itself can change can be overridden by indirect prompt injection.